The vulnerability is a high‑privilege internal operations flaw that allows an attacker with network access via HTTP to compromise Oracle Sales Offline. Successful exploitation results in a full takeover of the application, with confidentiality, integrity, and availability of the application being lost. The flaw is difficult to exploit but the potential impact is severe, as it can also lead to a scope change affecting other components of Oracle E‑Business Suite.

Oracle Sales Offline in the Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, are affected.

The CVSS base score of 8.0 signals high severity, and the EPSS score is less than 1%, indicating a low likelihood of exploitation at this time. The vulnerability is listed as not appearing in the CISA KEV catalog. The attack vector is remote network access over HTTP; the attacker must possess high privileges to exploit the internal operations component. A successful attack can lead to complete takeover of Oracle Sales Offline and potentially expand to other suite components due to the scope change.