This vulnerability exists in Oracle HRMS (Norway) within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 7.7, reflecting high confidentiality impact with attack vector network, low attack complexity, low privileges required, no user interaction, and scope change. The vulnerability is associated with CWE-200 (Exposure of Sensitive Information) and CWE-284 (Improper Access Control). The vendor advisory linked does not explicitly confirm patch availability or remediation level for this specific vulnerability, but it is part of the July 2026 Critical Patch Update which includes many fixes. Customers are urged to apply patches promptly as per Oracle's general guidance.

Successful exploitation leads to unauthorized disclosure of sensitive data within Oracle HRMS (Norway). The attacker gains access to critical data or complete access to all data accessible by the affected product. There is no impact on data integrity or availability. The vulnerability may also affect other Oracle products due to scope change, potentially broadening the impact beyond Oracle HRMS (Norway).

Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until a specific patch is confirmed, restrict network access to Oracle HRMS (Norway) interfaces where possible and monitor for unusual access patterns. Follow Oracle's security best practices for patch management and system hardening.