This vulnerability affects Oracle Human Resources within Oracle E-Business Suite versions 12.2.14 and 12.2.15. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise the Oracle Human Resources application. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or access all data accessible by the application. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that the attack requires local access with low complexity and privileges, no user interaction, and results in high confidentiality and integrity impacts but no availability impact. No official patch or remediation level is specified in the advisory, and no known exploits in the wild have been reported as of the publication date. The vendor advisory references the Oracle Critical Patch Update July 2026 but does not explicitly confirm a patch for this vulnerability.

The vulnerability allows unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Human Resources. This compromises confidentiality and integrity of sensitive HR data. The attack requires local access with low privileges but can lead to significant data compromise within the affected Oracle Human Resources environment.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict local access to the infrastructure hosting Oracle Human Resources to trusted users only.