This vulnerability affects Oracle US Federal Human Resources in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, with a base score of 7.1. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle advises customers to remain on supported versions and apply patches without delay to mitigate exploitation risks.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle US Federal Human Resources, and unauthorized read access to some data. This impacts confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges, increasing risk.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 as soon as possible. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.