This vulnerability affects Oracle HRMS (Japanese) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTPS to compromise the system, contingent on human interaction by a third party. Successful exploitation can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 5.4, reflecting low complexity and no privileges required but requiring user interaction. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability in the provided content. Oracle advises customers to remain on supported versions and apply patches without delay.

The vulnerability allows unauthorized read and write access to some data within Oracle HRMS (Japanese), potentially compromising confidentiality and integrity of that data. There is no impact on availability. Exploitation requires network access via HTTPS and human interaction from a user other than the attacker. This could lead to unauthorized data modification or disclosure within affected Oracle HRMS environments.

The vendor advisory does not explicitly confirm the availability of a patch or remediation for this vulnerability. Oracle's general guidance is to apply Critical Patch Updates promptly and remain on actively supported versions. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed, organizations should consider risk mitigation strategies consistent with the requirement for user interaction, such as user awareness and limiting network exposure of affected systems.