The Oracle Marketing from an access control weakness that permits a low-privileged attacker with network connectivity via HTTP to obtain unauthorized read and write access to marketing data. Attackers can read confidential content with high impact and perform insert, update, or delete operations, breaching the confidentiality and integrity of the application. This flaw is classified as CWE-284, reflecting incorrect or missing application authorization controls.

Oracle Corporation’s Oracle Marketing product, part of Oracle E-Business Suite, is affected. All releases from version 12.2.3 through 12.2.15 are susceptible. The vulnerability resides in the Audience component, but the scope change may allow impacts on other Oracle Marketing services within the same installation.

The CVSS v3.1 score of 8.5 indicates a high severity assessment, while the EPSS score of less than 1% suggests a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog. Attackers require only low privileges over HTTP to exploit the weakness, and successful exploitation can grant widespread read and write capabilities across all Oracle Marketing data. Despite the low exploitation probability, the potential for extensive data compromise warrants immediate remediation.