The vulnerability exists in the Applications DBA component (AD Utilities) of Oracle E-Business Suite. It permits a low‑privileged attacker who has logged on to the infrastructure where Applications DBA runs to compromise the product and ultimately take it over. Successful attacks require the attacker’s interaction with another person. The impact is a complete compromise that could affect confidentiality, integrity, and availability of the DBA system. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, giving a Base Score of 7.3.

Oracle Corporation’s Applications DBA product, part of Oracle E‑Business Suite, has affected supported versions from 12.2.3 through 12.2.15. The component affected is AD Utilities. The vulnerability is not limited to a single patch level but spans all releases within this range.

The attack vector is local, but the requirement for user interaction means the attacker must influence or coerce a non‑attacker user. Because EPSS data is not available, the likelihood of exploitation cannot be quantified precisely; however, the CVSS score indicates moderate to high severity. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is known, but the local nature and low privilege barrier could allow insider or compromised local accounts to exploit the flaw. Without a patch or workaround, an organization that allows local access to the Applications DBA servers is at risk of losing full control over the database environment.