Vulnerability in Oracle Sourcing’s Auctions component allows a low‑privileged attacker who can reach the service over HTTP to compromise the application. Successful exploitation can lead to a complete takeover, resulting in loss of confidentiality, integrity, and availability for the Sourcing product.

Oracle Corporation Sourcing product, affected versions 12.2.3 through 12.2.15.

The CVSS 3.1 base score of 7.5 indicates high severity, while the EPSS score of < 1% shows a very low, but non‑zero, probability of exploitation, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is remote network access over HTTP with low privilege, no user interaction, and high complexity. Exploitation would provide the attacker with the ability to fully control the Sourcing application.