This vulnerability affects Oracle HRMS (UK) component of Oracle E-Business Suite, specifically versions 12.2.8 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The vulnerability is difficult to exploit and has a CVSS 3.1 score of 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. The vulnerability may also affect other Oracle products beyond HRMS (UK). The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update containing many fixes. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle HRMS (UK). The confidentiality of sensitive information is at high risk. There is no impact on data integrity or availability. The vulnerability scope extends beyond Oracle HRMS (UK) to potentially affect additional Oracle products.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a specific patch is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.