This vulnerability affects Oracle HR Intelligence versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access over HTTP to compromise the system. The CVSS 3.1 base score is 7.2 with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains targeted security fixes. Oracle strongly advises customers to apply these patches without delay to mitigate the risk of exploitation. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may disrupt normal operations.

Successful exploitation can lead to complete compromise of Oracle HR Intelligence, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly. Until patches are applied, risk can be mitigated by blocking network protocols required for the attack and removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is confirmed by the vendor advisory, indicating that an official fix is available.