This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 and enables a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle HRMS (UK) and possibly other Oracle products due to scope change. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) lists this vulnerability among many patched in the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific CVE in the provided excerpt.

The vulnerability allows unauthorized actors with low privileges and network access to perform critical unauthorized actions such as creating, deleting, or modifying sensitive data in Oracle HRMS (UK). The scope change indicates that exploitation may affect additional Oracle products beyond HRMS (UK), potentially broadening the impact. Confidentiality and integrity of data are severely compromised, but availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until official patches or fixes are confirmed and applied, restrict network access to Oracle HRMS (UK) systems where possible and monitor for unusual activity related to data modification.