This vulnerability affects Oracle HR Intelligence within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is classified as difficult to exploit but allows a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch for Oracle HR Intelligence 12.2.3. Oracle urges customers to apply available patches promptly and consider mitigating actions such as blocking network protocols or restricting privileges to reduce exploitation risk.

Successful exploitation can lead to complete compromise of Oracle HR Intelligence, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially leading to unauthorized data access and disruption of services.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, customers may reduce risk by blocking network protocols required for exploitation and by removing unnecessary privileges from users to limit attack surface. These mitigations may affect application functionality and should be tested accordingly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should monitor Oracle's official security alerts for updates.