This vulnerability affects Oracle HRMS (India) versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle HRMS (India). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability enables unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle HRMS (India). This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 immediately to remediate this vulnerability. Oracle strongly advises staying on actively supported versions and applying security patches promptly to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.