This vulnerability affects Oracle HRMS (UK) versions 12.2.3 through 12.2.15 and arises from improper access control (CWE-284) allowing a low privileged attacker with network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, or modification, and to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Customers are strongly advised to review the advisory and apply any relevant patches promptly.

Successful exploitation can lead to unauthorized modification of critical data within Oracle HRMS (UK) and partial denial of service conditions. Confidentiality is not impacted, but integrity and availability are affected. This could compromise business processes relying on HRMS data integrity and availability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Until patches are applied, limit network access to Oracle HRMS (UK) systems to trusted users only and monitor for unusual activity consistent with unauthorized data modification or service disruption.