This vulnerability affects Oracle HRMS (Norway) versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. The scope of the vulnerability is changed, meaning it may affect additional Oracle products beyond HRMS (Norway). Successful exploitation can lead to unauthorized access to critical or complete data within Oracle HRMS (Norway). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

The vulnerability allows unauthorized access to critical or all data accessible by Oracle HRMS (Norway), potentially compromising sensitive information. The confidentiality impact is high, but there is no direct impact on data integrity or availability. The vulnerability affects the confidentiality of data handled by Oracle HRMS (Norway) and may extend its impact to other Oracle products due to scope change.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until official patches or mitigations are confirmed, restrict network access to Oracle HRMS (Norway) instances and monitor for suspicious activity related to this vulnerability.