This vulnerability affects Oracle HRMS (France) versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system by gaining unauthorized update, insert, delete, and read access to some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisory from Oracle does not explicitly confirm a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update which includes many patches. Customers are urged to apply available patches promptly. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized read and modification (update, insert, delete) of some data accessible through Oracle HRMS (France). This compromises confidentiality and integrity of affected data but does not affect availability. The attacker requires network access and low privileges but no user interaction is needed.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.