Oracle Receivables is affected by a flaw in its internal operations component that permits a high‑privileged attacker who can reach the application over HTTP to execute an escape from the application’s normal access controls, effectively taking over the system. The vulnerability leads to unrestricted access that compromises confidentiality, integrity, and availability of the entire Oracle Receivables instance. The CVSS 3.1 vector confirms that an attacker with high privileges and no user interface interaction can achieve this outcome.

Oracle Corporation’s Oracle Receivables within Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, are impacted. The vulnerability resides in the internal operations component of this product.

The CVSS base score of 7.2 indicates a high‑severity flaw, yet the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, implying no widespread compromise has been reported. Attacks would occur over the network via HTTP and require an attacker who already has high‑level credentials or has gained high‑privilege access on the network, making it a significant risk for exposed or poorly segmented environments.