This vulnerability affects Oracle HRMS (UK) versions 12.2.8 through 12.2.15 and involves a flaw in the Internal Operations component of Oracle E-Business Suite. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data within Oracle HRMS (UK). The vulnerability has a CVSS 3.1 score of 6.3 with attack vector network, high attack complexity, low privileges required, no user interaction, and confidentiality impact classified as high. The vulnerability scope is changed, meaning it may affect additional Oracle products beyond HRMS (UK). The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a July 2026 Critical Patch Update containing numerous security fixes. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle HRMS (UK). The vulnerability does not impact integrity or availability but compromises confidentiality. The attack requires network access via HTTP and low privileges but is difficult to exploit. The scope change indicates potential impact on additional Oracle products beyond HRMS (UK). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant Critical Patch Updates promptly and remaining on actively supported versions. No vendor advisory states that no action is required or that the issue is already mitigated.