This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 and is classified under CWE-284 (Improper Access Control). It enables a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical data and the ability to modify some data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, required privileges of low, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) does not explicitly state patch availability or remediation level for this specific vulnerability but references a Critical Patch Update containing multiple patches. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle HRMS (UK), as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability.

The vendor advisory does not explicitly confirm patch availability or remediation status for this vulnerability. Oracle recommends applying Critical Patch Updates promptly to address security vulnerabilities. Users should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status is not yet confirmed for this specific vulnerability; therefore, check the vendor advisory for current remediation guidance.