This vulnerability affects Oracle HR Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable by a high privileged attacker with network access via HTTP, allowing compromise and takeover of Oracle HR Intelligence. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in the June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly urges customers to apply these patches without delay to mitigate the risk. Workarounds include blocking required network protocols and removing unnecessary privileges, but these may disrupt application functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle HR Intelligence, resulting in complete takeover. The impact affects confidentiality, integrity, and availability of the affected product. This can lead to unauthorized data access, modification, and service disruption within Oracle HR Intelligence.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.