This vulnerability affects Oracle iRecruitment within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low-privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical data and unauthorized modification capabilities (update, insert, delete) on some accessible data. The vulnerability has a CVSS 3.1 score of 8.5, reflecting high confidentiality impact and moderate integrity impact, with no impact on availability. The vulnerability also has a scope change, potentially affecting other Oracle products. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle strongly recommends applying these patches promptly.

Successful exploitation allows unauthorized access to critical data within Oracle iRecruitment and unauthorized modification (update, insert, delete) of some data. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, other Oracle products may also be impacted by attacks exploiting this vulnerability.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle iRecruitment versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation.