The Oracle Order Management product contains a flaw in its Transaction Entry component that permits a low‑privileged attacker with network access over HTTP to gain unauthorized access to critical data or full control over all order‑management information. The CVSS vector shows a high confidentiality impact, but no effects on integrity or availability. This weakness can be abused to read protected data without authentication, leading to privacy breaches.

Oracle Corporation’s Oracle Order Management is affected. All supported versions from 12.2.3 through 12.2.15 are vulnerable. The issue resides in the Transaction Entry portion of the E‑Business Suite.

The CVSS base score of 5.3 indicates moderate severity with a focus on confidentiality. The EPSS score is 0.284%, indicating a very low exploitation probability; however, the vulnerability can be leveraged by remote actors over the network without elevated privileges. It is not listed in the CISA KEV catalog, yet exposed systems remain at risk because the flaw requires only HTTP access and can be triggered by a low‑privileged attacker.