The Oracle Knowledge Management product of Oracle E‑Business Suite has a vulnerability that allows a low‑privileged attacker with network access via HTTP to compromise the application and bypass authorization controls. Successful exploitation permits the attacker to update, insert, or delete data and to read a subset of protected data, thereby compromising the integrity and confidentiality of the application’s information assets.

Oracle Knowledge Management, part of Oracle E‑Business Suite, is affected in the supported releases 12.2.3 through 12.2.15.

The vulnerability has a CVSS 3.1 base score of 5.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting that widespread exploitation is unlikely at present. It is not listed in the CISA KEV catalog. Attackers need only low‑privileged network access to the Knowledge Management UI over HTTP; once reached, they can manipulate or view restricted data without proper authorization.