This vulnerability affects Oracle HRMS (US) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system by unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data. Additionally, the attacker can cause a partial denial of service condition. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. The vendor advisory from Oracle references this vulnerability in their July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific CVE. Oracle strongly recommends applying security patches promptly to mitigate known vulnerabilities.

Successful exploitation allows unauthorized read access to a subset of Oracle HRMS (US) data, unauthorized update, insert, or delete access to some accessible data, and the ability to cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system to a limited extent as reflected by the CVSS score of 6.3.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.