This vulnerability affects Oracle HRMS (UK) versions 12.2.9 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle HRMS (UK). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not yet confirmed.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical or all accessible data within Oracle HRMS (UK). This compromises confidentiality and integrity of sensitive HRMS data. There is no impact on availability reported. The vulnerability allows attackers with low privileges and network access to escalate their access to critical data, posing a significant risk to data security and business operations relying on Oracle HRMS (UK).

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay once available. Until a patch is released, consider restricting network access to Oracle HRMS (UK) HTTP interfaces to trusted users only and monitor for unusual activity related to HRMS data access. Do not assume the vulnerability is mitigated without official confirmation from Oracle.