This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data within Oracle HRMS (UK). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory includes patches for this vulnerability, emphasizing the importance of applying security updates without delay.

Exploitation of this vulnerability can result in unauthorized disclosure of critical data or complete data accessible by Oracle HRMS (UK). Additionally, it allows unauthorized modification of some data via update, insert, or delete operations. There is no reported impact on system availability. The vulnerability poses a high risk to confidentiality and a moderate risk to data integrity within affected Oracle HRMS (UK) environments.

Oracle has released security patches as part of the July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) that address this vulnerability. Customers are strongly advised to apply these patches promptly to remediate the issue. No alternative mitigations or workarounds are specified in the advisory. Maintaining up-to-date patching on supported versions is critical to prevent exploitation.