This vulnerability arises because the Oracle MES for Process Manufacturing component does not properly enforce access controls for internal operations accessed over HTTP. The flaw allows an attacker with only low-level privileges and network connectivity to exploit the system, resulting in unauthorized access to critical data or complete access to all Oracle MES accessible data. The weakness stems from insufficient authentication checks, amounting to an improper access control flaw.

Oracle MES for Process Manufacturing product of Oracle E‑Business Suite, specifically the Internal Operations component, is affected. Versions 12.2.3 through 12.2.15 are listed as vulnerable. The flaw may also impact other products due to a scope change, though the primary target is MES.

The CVSS score of 7.7 indicates a high severity, with the attack vector set to network, a low access complexity, and a low privilege requirement. Because the attacker only needs low privileges and no user interaction, exploitation likelihood is significant. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. Attackers can use the unencrypted HTTP channel to read confidential manufacturing information, and the scope change raises the risk to other affected products.