This vulnerability exists in the US Payroll - General component of Oracle HRMS (US) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows a high privileged attacker with network access over HTTP to compromise the Oracle HRMS (US) system. The vulnerability has a CVSS 3.1 score of 8.0 with high impact on confidentiality, integrity, and availability, and a scope change that may affect other Oracle products. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in complete takeover of Oracle HRMS (US), impacting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products may also be significantly affected. The vulnerability requires high privileges and network access via HTTP, and is rated high severity (CVSS 8.0). No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches from Oracle promptly to remediate the issue. Oracle strongly advises remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the vendor advisory.