This vulnerability affects Oracle HRMS (US) versions 12.2.9 to 12.2.15 and allows a low privileged attacker with logon access to the infrastructure where Oracle HRMS (US) executes to compromise the application. Successful exploitation can result in unauthorized ability to cause a hang or frequent crashes (complete denial of service) and unauthorized update, insert, delete, and read access to some accessible data within Oracle HRMS (US). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact but high availability impact.

The vulnerability enables an attacker with low privileges and logon access to cause a denial of service by hanging or crashing Oracle HRMS (US). Additionally, the attacker can perform unauthorized read and write operations on some data accessible by Oracle HRMS (US), potentially compromising confidentiality and integrity of that data. The overall impact affects confidentiality, integrity, and availability with a medium severity rating.

Oracle has published a Critical Patch Update advisory for July 2026 that includes security patches for multiple vulnerabilities. Customers are strongly advised to apply the relevant patches from this update promptly to remediate this vulnerability. The vendor advisory does not specify if a patch is currently available specifically for Oracle HRMS (US) versions 12.2.9-12.2.15, so users should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Until patches are applied, restricting access to the infrastructure and limiting privileges may reduce risk.