This vulnerability affects Oracle HCM Common Architecture component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and low integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and recommends applying patches promptly.

Successful exploitation can lead to unauthorized access to all data accessible by Oracle HCM Common Architecture and unauthorized update, insert, or delete operations on some data. This compromises confidentiality and integrity of the affected system's data, potentially exposing sensitive information or allowing data manipulation by attackers without authentication.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches without delay to mitigate the risk. No additional mitigation steps are specified beyond applying the official patch. Patch status is confirmed by the vendor advisory.