A flaw in Oracle Bills of Material allows a low‑privileged attacker who can reach the application over HTTP to create, delete, or modify critical data, or to gain unrestricted access to all bills of material information. The vulnerability leads to high confidentiality and integrity impacts, exposing sensitive enterprise data to unauthorized use or tampering.

The issue affects Oracle Bills of Material within Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15. Any user who can authenticate with low privileges on a system exposed to HTTP traffic is capable of exploiting the flaw.

The CVSS v3.1 base score of 8.1 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates a low overall likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack route requires network access to the Bills of Material HTTP interface from a low‑privileged account; no specialized tools or elevated privileges are needed to launch the attack.