This vulnerability affects Oracle HRMS (Norway) versions 12.2.3 to 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system by unauthorized modification and reading of some accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, requires high privileges, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. The Oracle July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a patch or remediation for this vulnerability. Customers are advised to apply available patches promptly to mitigate known vulnerabilities.

Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle HRMS (Norway) accessible data and unauthorized read access to a subset of that data. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires high privileges and network access via HTTP, limiting the attack surface to privileged users with network connectivity.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Until an official patch is confirmed, restrict network access to Oracle HRMS (Norway) to trusted users and monitor for suspicious activity involving privileged accounts.