This vulnerability affects Oracle HCM Configuration Workbench, a component of Oracle E-Business Suite Rapid Implementation, specifically versions 12.2.3 to 12.2.15. It enables an attacker with low privileges and network access over HTTP to compromise the system, leading to unauthorized access to sensitive or critical data within the Oracle HCM Configuration Workbench environment. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No official patch or remediation level is explicitly stated in the advisory, but Oracle’s July 2026 Critical Patch Update advisory should be consulted for patch availability and installation instructions.

Successful exploitation of this vulnerability can result in unauthorized access to critical or all accessible data within Oracle HCM Configuration Workbench. The confidentiality of sensitive information is at high risk, while integrity and availability are not impacted according to the CVSS vector. This could lead to data exposure and potential compliance or privacy issues for affected organizations.

Oracle’s July 2026 Critical Patch Update advisory should be reviewed for patch availability and installation instructions. Since no explicit remediation level or patch is stated in the provided data, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions to mitigate exploitation risks.