The vulnerability is an improper access control flaw that allows low‑privileged users with HTTP network access to gain full control of the Oracle Project Intelligence application. The weakness, enumerated as CWE‑269, ‑284, ‑287, and ‑306, facilitates unauthorized privilege escalation, broken authentication, and inadequate authorization. Successful exploitation results in full compromise, destroying confidentiality, integrity, and availability of the system.

Oracle Corporation’s Oracle Project Intelligence component of Oracle E‑Business Suite – the Internal Operations module – is affected in versions 12.2.3 through 12.2.15. The product is accessed via HTTP and is commonly deployed in enterprise environments.

The CVSS v3.1 base score of 8.8 indicates high severity, yet the EPSS score of less than 1 % reflects a low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The description specifies that the attack requires only low‑privileged credentials and network access over HTTP, suggesting a remote exploit available to anyone who can reach the application. If present, an attacker could execute arbitrary administrative actions, potentially compounding the impact and enabling a full takeover of the application.