This vulnerability affects Oracle HRMS (Norway) versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to perform unauthorized data modifications (update, insert, delete) and unauthorized read access to some data within the Oracle HRMS (Norway) product. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no impact on availability. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but advises applying Critical Patch Updates generally.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle HRMS (Norway). The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires a high privileged attacker with network access via HTTP, limiting the attack surface. The CVSS score of 3.8 reflects a low severity level.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a specific patch is confirmed, restrict network access to Oracle HRMS (Norway) interfaces to trusted users and monitor for suspicious activity by high privileged accounts.