The vulnerability exists within the Case Management Service component of Oracle Business Process Management Suite, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker who can reach the system over HTTP can exploit an unauthenticated pathway, enabling them to read critical data and perform unauthorized updates, insertions, or deletions. The impact includes confidentiality loss on requested data and possible integrity degradation where the attacker modifies stored information, as quantified by a CVSS 3.1 Base Score of 8.2.

Affected systems are Oracle Corporation's Oracle Business Process Management Suite, specifically the Case Management Service release 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is not limited to a particular operating system; it is tied to these software releases within the Oracle Fusion Middleware stack.

The CVSS score of 8.2 indicates a high severity level. The EPSS score is 0.00339 (approximately 0.34%) indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via HTTP and does not require prior authentication, enabling unauthenticated attackers to compromise the system if the network exposure is not restricted.