This vulnerability affects Oracle HRMS (UK) versions 12.2.3 through 12.2.15 within Oracle E-Business Suite's Internal Operations component. It is difficult to exploit but allows a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle HRMS (UK). The vulnerability has a CVSS 3.1 score of 8.2 with attack vector network, high attack complexity, low privileges required, no user interaction, and scope changed. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle advises customers to remain on supported versions and apply patches without delay. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle HRMS (UK), as well as unauthorized access to all data accessible by the product. The vulnerability affects confidentiality and integrity with a high severity score (CVSS 8.2). The scope change indicates potential impact on additional Oracle products beyond Oracle HRMS (UK). There are no reported exploits in the wild currently.

Oracle has published this vulnerability as part of their July 2026 Critical Patch Update advisory. However, no explicit patch or remediation level is confirmed for this specific vulnerability in the advisory. Customers should monitor Oracle's official security alerts and apply Critical Patch Updates promptly when patches for this vulnerability become available. Until an official fix is released, no specific workaround or temporary fix is documented. Maintaining supported versions and timely patch application is strongly recommended by Oracle.