This vulnerability affects Oracle iRecruitment, a component of Oracle E-Business Suite (Internal Operations). It is exploitable by an attacker with high privileges and network access via HTTP, enabling compromise of the affected system. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The affected versions explicitly include 12.2.3 through 12.2.15. The vendor advisory from Oracle references this vulnerability in their July 2026 Critical Patch Update but does not explicitly state patch availability or remediation level for this specific CVE. No known exploits in the wild have been reported at this time.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle iRecruitment, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, or denial of service within the affected application.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle iRecruitment to trusted users with high privileges only.