This vulnerability affects Oracle HCM Configuration Workbench, a component of Oracle E-Business Suite Rapid Implementation, in versions 12.2.3 through 12.2.15. It permits a high privileged attacker with network access via HTTP to compromise the system, resulting in complete takeover. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches and strongly recommends applying patches promptly. The advisory does not explicitly list a fixed version or patch link for this specific vulnerability, so users must verify patch availability via the official Oracle advisory.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle HCM Configuration Workbench. This results in complete loss of confidentiality, integrity, and availability of the affected system component. The impact is severe, potentially enabling full system takeover.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among many others. Customers are strongly advised to remain on actively supported versions and apply the security patches from the July 2026 Critical Patch Update without delay. Patch status for this specific vulnerability is not explicitly confirmed in the advisory text provided; therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current patch availability and installation instructions.