This vulnerability affects Oracle iRecruitment versions 12.2.3 to 12.2.15 and requires an attacker to have physical access to the communication segment connected to the hardware where Oracle iRecruitment runs. The flaw allows unauthorized actors to create, delete, or modify critical data or gain complete access to all data accessible by Oracle iRecruitment. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack vector is adjacent network with high attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across multiple products. The vendor strongly recommends applying available patches promptly to mitigate exploitation risks.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle iRecruitment, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of sensitive data managed by Oracle iRecruitment. The attack requires physical access to the communication segment, limiting the attack surface to environments where such access is possible.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Since the vulnerability requires physical access to the communication segment, restricting physical access to hardware and network segments running Oracle iRecruitment can reduce risk. Patch status is confirmed by the vendor advisory, indicating an official fix is available.