A remote attacker who has only low privilege and can reach the system over the network via HTTP can exploit a vulnerability in the Oracle Contract Lifecycle Management for Public Sector component Award/PO. The flaw allows the attacker to gain full control of the application, resulting in compromised confidentiality, integrity, and availability of the system.

Oracle Contract Lifecycle Management for Public Sector, part of Oracle E‑Business Suite, affected versions are 12.2.3 through 12.2.15. The vulnerability resides in the Award/PO component of the product.

The vulnerability scores a CVSS 3.1 base score of 8.8, indicating high severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, but the lowest privilege requirement and network‑based attack vector mean it can be abused easily by threat actors with Internet access. If exploited, the attacker can take over the entire application, posing a significant threat to the confidentiality, integrity, and availability of enterprise data stored within the contract lifecycle management system.