This vulnerability affects Oracle Human Resources within Oracle E-Business Suite, specifically versions 12.2.14 and 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with low attack complexity and no user interaction required. The vulnerability is publicly disclosed and documented under CVE-2026-62468. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability, so patch status remains unconfirmed.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Human Resources, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector. The attacker requires only low privileges and network access via HTTP, making exploitation relatively easy.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Human Resources interfaces to trusted users only and monitor for suspicious activity related to unauthorized data changes.