This vulnerability affects Oracle HRMS (US) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise Oracle HRMS (US), potentially resulting in complete control over the application. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update advisory that includes patches for this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly.

Successful exploitation can lead to full compromise of Oracle HRMS (US), affecting confidentiality, integrity, and availability of the system. This means attackers could potentially access sensitive payroll and tax data, modify or disrupt system operations, and gain control over the application environment.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying all security updates. No alternative mitigations or workarounds are indicated in the advisory.