This vulnerability affects Oracle iRecruitment, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It permits unauthenticated remote attackers to compromise the system via HTTP, resulting in unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely over the network with low attack complexity, no privileges, and no user interaction, impacting confidentiality but not integrity or availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation level for Oracle iRecruitment in the provided excerpt.

Successful exploitation leads to unauthorized access to critical or all data accessible through Oracle iRecruitment. This compromises confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of data breaches.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities, including this one. However, the advisory content provided does not explicitly confirm the availability of a patch or remediation for Oracle iRecruitment. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until confirmed, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.