This vulnerability affects Oracle iRecruitment component of Oracle E-Business Suite in versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to unauthorized access to critical or all data accessible through Oracle iRecruitment, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing risk exposure.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle iRecruitment interfaces where possible to reduce exposure.