This vulnerability affects Oracle HRMS (US) versions 12.2.3 to 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system. The attack can result in unauthorized access to critical or all accessible data within Oracle HRMS (US). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability may also impact additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific CVE in the provided excerpt.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle HRMS (US). The confidentiality impact is high, while integrity and availability impacts are not affected. The vulnerability requires high privileges and network access via HTTP, and it affects the confidentiality of sensitive information within Oracle HRMS (US). The scope change indicates potential impact on additional Oracle products beyond HRMS (US).

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. No explicit vendor advisory states that no action is required or that the vulnerability is already mitigated.