This vulnerability affects Oracle HRMS (Netherlands) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with high privileges and network access via HTTP. Successful exploitation can result in complete compromise of the Oracle HRMS (Netherlands) system. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references the August 2026 Critical Security Patch Update which includes security patches for Oracle E-Business Suite among many other products.

The vulnerability allows a high privileged attacker with network access to fully compromise Oracle HRMS (Netherlands), impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, or disruption of services within the affected Oracle HRMS environment.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to affected versions (12.2.3 through 12.2.15) of Oracle HRMS (Netherlands). No indication is given that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory. There is no mention of cloud service remediation, so patching is customer responsibility.