This vulnerability affects Oracle Human Resources in Oracle E-Business Suite versions 12.2.14 and 12.2.15. It is exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Human Resources. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Human Resources. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H), with no availability impact (A:N). The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

The vulnerability allows unauthorized modification and access to critical data within Oracle Human Resources, potentially compromising confidentiality and integrity of sensitive HR data. This could lead to unauthorized data manipulation or exposure of all data accessible by the affected Oracle Human Resources installation. There is no reported impact on availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory includes numerous patches and strongly recommends applying security patches without delay. Until an official patch or workaround is confirmed, restrict access to the infrastructure hosting Oracle Human Resources to trusted users only and monitor for suspicious activity. Follow Oracle's guidance for patch application once available.