The vulnerability is an easily exploitable flaw in the internal operations component of Oracle Demand Signal Repository, enabling a low‑privilege attacker who can reach the system over HTTP to perform unauthorized create, delete, or modify operations on critical data, and potentially gain read access to the entire repository. This flaw is an Improper Access Control vulnerability (CWE‑284), resulting in a compromise of confidentiality and integrity, as reflected by the CVSS vector that emphasizes high impact on these categories.

The flaw affects Oracle Corporation’s Demand Signal Repository, part of Oracle E‑Business Suite, for all supported versions from 12.2.3 through 12.2.15. Any environment running those releases is susceptible unless a patch that addresses this issue has been applied.

With a CVSS base score of 8.1 and an EPSS of less than 1%, the vulnerability presents a high severity but a low probability of exploitation at present. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no publicly documented exploitation. Attackers would need network access to the HTTP interface and a low‑level account; no additional privileges or special conditions are required, which makes the attack path straightforward for reconnaissance or internal threat actors.