This vulnerability affects Oracle Public Sector Human Resources component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is difficult to exploit but requires a high privileged attacker with network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability among 943 other security patches. The vendor strongly recommends applying these patches without delay to prevent exploitation.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Public Sector Human Resources. This leads to a significant confidentiality and integrity impact on the affected data. The vulnerability may also affect additional Oracle products due to scope change. There are no reported exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Users of Oracle Public Sector Human Resources versions 12.2.3 through 12.2.15 should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively supported versions and applying all security patches without delay to mitigate this and other vulnerabilities. No additional mitigation actions are specified beyond patching.