This vulnerability affects Oracle HR Intelligence within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized modification of critical or all accessible data and can cause a hang or frequent crashes resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. The vendor advisory is part of Oracle's September 2026 Critical Security Patch Update, which includes patches for this vulnerability.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle HR Intelligence, compromising data integrity. Additionally, it can cause the application to hang or crash repeatedly, resulting in a complete denial of service, impacting availability. There is no confidentiality impact reported. The vulnerability requires network access and low privileges but is difficult to exploit.

Oracle has released patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle HR Intelligence versions 12.2.3 through 12.2.15 should apply the relevant security patches promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory linked in the report.