This vulnerability affects Oracle HRMS (US) versions 12.2.3 to 12.2.15 and involves a flaw in the Internal Operations component. An attacker with low privileges and network access via HTTP can exploit this issue to read unauthorized data subsets and cause partial denial of service conditions. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay.

Successful exploitation can lead to unauthorized read access to a subset of data accessible by Oracle HRMS (US) and the ability to cause a partial denial of service affecting availability. The confidentiality impact is low, integrity impact is none, and availability impact is low. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the risk to some extent.

Oracle's advisory does not explicitly confirm a patch or remediation level for this vulnerability. Customers should review the Oracle Critical Patch Update for July 2026 and apply all relevant security patches promptly as recommended by Oracle. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.