This vulnerability affects the Oracle iRecruitment component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that permits a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle iRecruitment. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle iRecruitment. This includes the ability to create, delete, or modify data, potentially compromising the confidentiality and integrity of the system's data. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Since the vendor advisory does not indicate that the vulnerability is already mitigated or requires no action, applying the official patches is the recommended mitigation. Patch status is not explicitly confirmed in the advisory text provided; therefore, users should consult the Oracle Critical Patch Update July 2026 advisory directly for detailed patch availability and installation instructions.