A low privileged attacker with network access via HTTP can exploit a vulnerability in Oracle Contract Lifecycle Management for Public Sector, specifically the Award/PO component, to fully compromise the system. The flaw allows the attacker to override confidentiality, integrity, and availability controls, resulting in a complete takeover of the application. The weakness is an access control flaw (CWE-284) and a privilege management flaw (CWE-269).

Oracle Corporation’s Oracle Contract Lifecycle Management for Public Sector version 12.2.13 through 12.2.15 are affected. No other vendors or versions are listed as vulnerable.

The CVSS v3.1 score of 8.8 indicates high severity, while the EPSS score of less than 1% shows a low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. This flaw is an access control (CWE-284) and privilege management (CWE-269) weakness. Based on the description, it is inferred that the attack vector is network-based via HTTP and requires only local privilege to succeed. An attacker could use standard web requests to trigger the flaw and achieve system compromise.