This vulnerability affects Oracle Public Sector Human Resources component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is classified under CWE-284 (Improper Access Control). The flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access, enabling creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with no user interaction required. The vendor advisory linked is a general Critical Patch Update advisory for July 2026 but does not explicitly confirm patch availability or remediation for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Public Sector Human Resources. This compromises the confidentiality and integrity of sensitive information managed by the product. There is no indication of impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit if unpatched.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until an official patch is confirmed and applied, restrict network access to Oracle Public Sector Human Resources and monitor for unusual activity related to this product.