The vulnerability in Oracle General Ledger permits a low‑privileged attacker who can reach the system over HTTP to create, delete, or modify access rights for critical data, read protected data, and trigger a hang or crash that can be repeated arbitrarily. The flaw results in a loss of confidentiality for some data, a loss of integrity for all accessible data, and a denial of service for the application, as reflected by the CVSS score of 7.1.

Affected versions are Oracle E‑Business Suite General Ledger versions 12.2.3 through 12.2.15. The issue resides in the Internal Operations component of the product.

Because the attack requires only network access over HTTP and a user account with limited privileges, the exploitability is relatively straightforward for an adversary who can enumerate or obtain any valid Oracle credential. The CVSS Base Score of 7.1 indicates a high severity, and with no EPSS score available we cannot quantify current exploitation probability, but the lack of listing in the CISA KEV catalog suggests no known active exploitation as of now. The vulnerability remains a persistent threat to internal users who have legitimate access to the General Ledger.