The vulnerability is an authorization bypass in Oracle Process Manufacturing Logistics that allows a low‑privileged attacker with network access via HTTP to create, delete or modify critical data and to access all data in the system. The flaw permits unauthorized creation, deletion or modification of critical data or complete access to all accessible data, resulting in confidentiality and integrity loss. The vulnerability is classified as CWE‑284 and is reflected in a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact.

Oracle Process Manufacturing Logistics component of the Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. The flaw is present in the Internal Operations component and requires HTTP connectivity to the instance. Only those systems within this version range running the affected component are vulnerable.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1 % signals a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. Attackers would need network reach to the HTTP endpoint and a low‑privileged user account, implying the flaw is easily exploitable if network segmentation or access control is insufficient.