Oracle General Ledger contains a vulnerability that allows a high‑privileged user who can log on to the underlying infrastructure to modify, create or delete critical data and to obtain unauthorized access to all data the application manages. The flaw influences both confidentiality and integrity, enabling manipulation of business records.

The affected product is Oracle General Ledger, part of Oracle E‑Business Suite. Versions from 12.2.3 through 12.2.15 are impacted. No other products are listed as directly affected, but the scope of the vulnerability may extend to other Oracle components under the same deployment.

The CVSS base score of 7.2 indicates a high severity risk. The attack requires local privileged access but does not need network or user interaction to succeed. Because the vulnerability changes scope and directly affects data integrity, an attacker who succeeds can permanently alter accounting records. The EPSS score indicates a very low exploitation probability of 0.00103, and the vulnerability is not listed in CISA KEV, so publicly known exploitation evidence is not documented for this time. Nonetheless the high‑privileged prerequisite and potential for data compromise demand urgent attention.