This vulnerability exists in the Internal Operations component of Oracle iRecruitment within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data in Oracle iRecruitment. The vulnerability has a CVSS 3.1 base score of 7.7 with a vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products. Customers are strongly advised to apply the patches promptly.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle iRecruitment. The vulnerability affects confidentiality but does not impact integrity or availability. Additionally, the vulnerability may have a scope change effect, potentially impacting other Oracle products beyond iRecruitment.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated beyond patching.