A vulnerability in Oracle Project Intelligence allows a low‑privileged attacker with network access via HTTP to create, delete, or modify critical data. The flaw results in high confidentiality and integrity impact, with the potential for the attacker to take full control over all data accessible through Oracle Project Intelligence.

Oracle Project Intelligence component Internal Operations in Oracle E‑Business Suite, affecting versions 12.2.3 through 12.2.15.

The CVSS base score of 8.1 indicates a moderate‑to‑high severity, primarily affecting confidentiality and integrity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote network request to an HTTP endpoint, requiring the attacker to have minimal privileges and no user interaction. If successfully exploited the attacker could alter or delete critical data, disrupting business processes and compromising data integrity.