This vulnerability in Oracle HRMS (Australia) Payroll component version 12.2.3 enables a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all data accessible through HRMS (Australia). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. The affected version explicitly stated is 12.2.3.

Successful exploitation can lead to unauthorized access to critical or complete HRMS (Australia) data, compromising confidentiality. There is no reported impact on data integrity or availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing the risk of data exposure.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, restrict network access to the HRMS (Australia) HTTP interface to trusted users and monitor for unusual access patterns.