This vulnerability affects Oracle Human Resources in Oracle E-Business Suite versions 12.2.14 and 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Human Resources accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vulnerability is classified under CWE-284, indicating improper access control. There is no explicit vendor advisory stating a patch or fix availability for this specific vulnerability, but it is listed in the Oracle Critical Patch Update Advisory for July 2026, which contains multiple patches for various products. Oracle strongly recommends applying security patches promptly to mitigate such vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Human Resources, or unauthorized access to all data accessible by this product. This compromises the confidentiality and integrity of sensitive HR data. There is no impact on availability reported. The vulnerability can be exploited remotely over the network without user interaction by an attacker with low privileges.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches for Oracle Human Resources (Oracle E-Business Suite versions 12.2.14 and 12.2.15) without delay. Patch status is not explicitly confirmed in the advisory text provided, so customers should verify patch availability and installation instructions from the official Oracle advisory. No alternative mitigations or workarounds are specified.