This vulnerability affects Oracle HRMS (France) versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in high confidentiality and integrity impacts. The CVSS 3.1 base score is 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. The vendor advisory from Oracle does not explicitly confirm a patch availability or remediation level for this specific vulnerability but references the Critical Patch Update July 2026 advisory, which includes many patches. Users are advised to review the advisory and apply relevant patches promptly.

Successful exploitation of this vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle HRMS (France). This results in a high impact on confidentiality and integrity of the affected system's data. Availability is not impacted. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle HRMS (France) instances and monitor for suspicious activity related to unauthorized data modifications.