The vulnerability resides in Oracle iProcurement’s E‑Content Manager Catalog and is a missing access control flaw (CWE‑269) that permits authenticated users with high privileges to perform arbitrary actions through HTTP requests. This can lead to a full takeover of the application, compromising all sensitive data, services, and configuration. The impact covers confidentiality, integrity, and availability, according to the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Oracle Corporation iProcurement versions 12.2.3 up to 12.2.15 are affected. The flaw is present in the E‑Content Manager Catalog component of the Oracle E‑Business Suite.

The CVSS base score of 7.2 indicates a moderate-to-high risk to confidentiality, integrity, and availability. EPSS score of < 1%, which translates to a very low exploitation probability, suggests that large‑scale attacks are unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and the most likely attack vector is a remote network attack over HTTP targeting the application’s exposed endpoints, exploiting high‑privilege client credentials.