Vulnerability Description: The Oracle Common Applications product of Oracle E‑Business Suite contains a flaw in the CRM User Management Framework that enables a high‑privileged attacker who can reach the application over HTTP to compromise the system. According to the official announcement, an attacker who can gain network access and has the ability to interact with the application may cause complete takeover of Oracle Common Applications. The issue results in simultaneous confidentiality, integrity, and availability impacts, reflected in a CVSS 3.1 base score of 7.2. The vulnerability corresponds to privilege escalation issues identified by CWE-269.

Affected Systems: Oracle Common Applications for version ranges 12.2.3 through 12.2.15 are impacted. All installations that include the CRM User Management Framework component in these releases are vulnerable until a patch is applied or the product is upgraded beyond version 12.2.15.

Risk and Exploitability: The CVSS score of 7.2 indicates a high‑severity flaw, while its EPSS score of less than 1% suggests that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network connectivity to the HTTP port of Oracle Common Applications and must possess high‑privilege credentials to succeed. In the absence of these prerequisites, exploitation is unlikely.