This vulnerability affects Oracle Human Resources component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP without authentication but requires high attack complexity and user interaction from a third party. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability involves weaknesses categorized under CWE-601 (Open Redirect), CWE-79 (Cross-site Scripting), and CWE-352 (Cross-Site Request Forgery). Oracle has published a Critical Security Patch Update advisory including this vulnerability but has not explicitly stated patch availability or remediation level for this specific issue. Oracle strongly recommends applying the June 2026 Critical Security Patch Update to mitigate this and other vulnerabilities.

If successfully exploited, this vulnerability can lead to complete compromise of Oracle Human Resources, affecting confidentiality, integrity, and availability of the system. The attack requires network access via HTTP and user interaction from a third party, making exploitation difficult but potentially impactful. There are no known exploits in the wild at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this and numerous other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by restricting privileges or access to vulnerable packages for users who do not need them. Oracle advises customers to remain on actively supported versions and apply security patches promptly. Patch status for this specific vulnerability is not explicitly confirmed; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.