This vulnerability affects Oracle HR Intelligence in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, but these may disrupt normal operations.

Successful exploitation can lead to complete compromise of Oracle HR Intelligence, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially leading to unauthorized data access or disruption of services.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly advises remaining on actively supported versions and promptly applying security updates.