This vulnerability affects Oracle HRMS (France) versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle HRMS (France). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. The vendor advisory from Oracle’s July 2026 Critical Patch Update mentions a large set of patches but does not explicitly confirm a patch or remediation for this vulnerability. Patch status is therefore not yet confirmed and should be verified in the vendor advisory.

The vulnerability allows unauthorized access leading to creation, deletion, or modification of critical data within Oracle HRMS (France). This compromises confidentiality and integrity of sensitive HR data, potentially affecting business operations and data trustworthiness. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle HRMS (France) HTTP interfaces to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.