This vulnerability affects Oracle Public Sector Human Resources component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to certain accessible data within the product. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector (network), low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The vulnerability is categorized under CWE-284, indicating improper access control. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches from Oracle's Critical Patch Update advisories without delay.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Public Sector Human Resources. This compromises data confidentiality and integrity but does not impact system availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively straightforward if the system is exposed.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle strongly recommends customers remain on actively supported versions and apply Critical Patch Updates promptly. Check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.