The vulnerability stems from missing authentication checks that allow an attacker without credentials to reach the iProcurement service via HTTPS. This flaw gives the attacker the ability to create, delete, or modify critical data, resulting in a loss of data integrity and confidentiality.

Oracle Corporation’s iProcurement product of the E‑Business Suite is affected from version 12.2.3 through 12.2.15.

The CVSS base score of 7.4 indicates high severity owing to confidentiality and integrity impacts. No EPSS information is available, and the flaw is not listed in the CISA KEV catalog, but the attack vector is inferred to be over the network via HTTPS, making the flaw highly suitable for remote exploitation by an unauthenticated attacker.