This vulnerability affects Oracle HR Intelligence versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access over HTTP to compromise the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. While no explicit patch link for this specific CVE was provided, Oracle strongly recommends applying the June 2026 CSPU, which addresses this and other vulnerabilities. Mitigation options before patching include blocking relevant network protocols and removing unnecessary privileges from users, though these may disrupt normal operations.

Successful exploitation can lead to complete compromise of Oracle HR Intelligence, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the product, potentially leading to unauthorized data access, modification, or denial of service.

Oracle recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality, so they should be implemented with caution. Patch status is not explicitly stated for this CVE alone, but the vendor advisory confirms that the June 2026 CSPU includes fixes for this vulnerability.