The vulnerability is an insecure authentication flow within the Internal Operations component of Oracle Payables. A low‑privileged attacker with network access over HTTP can bypass normal login procedures, gaining full control of the system. This results in loss of confidentiality, integrity, and availability for the entire Payables application, matching the CWE classification of improper privilege management and authentication bypass.

Oracle Payables applications running Oracle E‑Business Suite versions 12.2.8 through 12.2.15 are impacted. These releases are listed in the security alert and contain the vulnerable authentication handling code in the Internal Operations area.

The CVSS base score of 8.8 highlights a severe threat, but the EPSS score of less than 1% indicates that, at present, the likelihood of widespread exploitation is low. The vulnerability is not listed in the CISA KEV catalog, so no known mass exploitation activity is documented. Attackers who discover or generate the required HTTP requests could exploit the flaw from any network location with access to the Payables web interface. No additional privilege or configuration changes are necessary to exploit the issue beyond the ability to send the crafted requests.