This vulnerability affects Oracle HR Intelligence versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector with low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. While no explicit patch link for this specific CVE is provided, Oracle strongly urges customers to apply the June 2026 CSPU, which addresses this and other vulnerabilities. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges from users, though these may disrupt application functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle HR Intelligence, resulting in complete takeover of the product. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS 3.1 score of 7.2.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update. Customers are strongly advised to apply the June 2026 CSPU promptly to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these mitigations may impact application functionality. Patch status is not explicitly confirmed for this CVE alone, but the vendor advisory indicates that the June 2026 CSPU addresses it. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.