This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 within Oracle E-Business Suite. It permits a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized ability to read, update, insert, or delete some accessible data and cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly state the availability of a fix for this vulnerability. The vendor strongly recommends applying patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of accessible data, and partial denial of service in Oracle HRMS (UK). This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and strongly recommends customers apply available patches promptly. However, the advisory does not explicitly confirm a patch for CVE-2026-62453. Therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a patch is confirmed and applied, limit network access to Oracle HRMS (UK) systems to trusted users and monitor for unusual activity related to unauthorized data access or modification.