This vulnerability affects Oracle HCM Configuration Workbench within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an attacker with low privileges and network access over HTTP to compromise the application, resulting in unauthorized ability to read, modify, or delete some accessible data and cause partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state the availability of a patch or workaround for this issue. Customers are advised to consult the advisory for patch information and to apply updates promptly.

Successful exploitation can lead to unauthorized read access to some data, unauthorized update, insert, or delete operations on accessible data, and partial denial of service conditions affecting Oracle HCM Configuration Workbench. The confidentiality, integrity, and availability impacts are rated low but combined justify a medium severity rating with a CVSS score of 6.3. No known active exploitation has been reported.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or provide specific remediation instructions for it. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed, consider restricting network access to the Oracle HCM Configuration Workbench service to trusted users only.