This vulnerability affects Oracle Public Sector Human Resources versions 12.2.3 to 12.2.15 and involves a flaw in the Regression Testing component that can be exploited by an attacker with low privileges and network access via HTTP. Successful exploitation permits unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact without availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly urges customers to apply patches promptly.

Exploitation of this vulnerability can lead to unauthorized modification (update, insert, delete) and unauthorized reading of certain data within Oracle Public Sector Human Resources. This compromises data confidentiality and integrity but does not affect system availability. The attacker requires network access and low privileges but no user interaction is needed. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches without delay. Staying on actively supported versions and promptly applying Oracle's security patches is strongly recommended to mitigate this vulnerability. Patch status is not explicitly confirmed in the advisory excerpt, so customers should verify patch availability and installation instructions in the official advisory.