The vulnerability resides in the Web Services component of Oracle Bills of Material. It is a case of insufficient access control that permits a low-privileged attacker, reachable over the network via HTTP, to perform unauthorized updates, inserts, deletes, and reads on Bills of Material data, as well as to induce a partial denial of service. These capabilities compromise confidentiality, integrity, and availability as reflected by the CVSS score of 6.3.

Oracle Bills of Material product of Oracle E-Business Suite, versions 12.2.3 through 12.2.15, is affected. Users running these releases are at risk.

The EPSS score of less than 1% suggests that while the flaw is easily exploitable, widespread attacks are unlikely. Attackers need only network access to the HTTP endpoint and low-privileged credentials; no elevated privileges or privileged network position are required. The CVSS vector indicates low attack complexity, low privilege, and no user interaction, underscoring the ease of exploitation. The flaw is not listed in CISA KEV, but it is addressed in Oracle’s CPU July 2026 advisory.