A vulnerability in Oracle Order Capture (E‑Business Suite, Internal Operations) allows a high‑privilege attacker with network access over HTTP to compromise the application. Successful exploitation results in a full takeover, exposing confidential data, allowing modification of records, and disrupting service availability. The weakness is a CWE‑200 information‑exposure flaw that permits an attacker to gain unauthorized privileged operations within the application.

The affected product is Oracle Order Capture, versions 12.2.3 through 12.2.15 inclusive, as identified by the CNA.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that remote access with low complexity can lead to significant confidentiality, integrity, and availability impacts but requires high privileged credentials. The EPSS score is reported as < 1%, reflecting a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is HTTP traffic from an attacker who already holds or has compromised high‑privilege credentials for Order Capture. While the likelihood of exploitation is limited, any successful attack would give the attacker full control over the application and its underlying data.