This vulnerability affects Oracle HRMS (India) versions 12.2.3 to 12.2.15 within the Oracle E-Business Suite. It is exploitable remotely over HTTPS by an attacker with low privileges, enabling unauthorized access to sensitive data and limited unauthorized modification capabilities. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which provides targeted security fixes. Customers are strongly advised to apply the relevant patches promptly as part of Oracle's security update process.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle HRMS (India), as well as unauthorized data modification (update, insert, delete) on some accessible data. This compromises confidentiality and partially impacts data integrity. There is no reported impact on availability. The vulnerability is exploitable remotely over HTTPS by an attacker with low privileges, increasing the risk of compromise if patches are not applied.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official patches provided by Oracle for Oracle E-Business Suite versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via Oracle's Critical Security Patch Update advisory. No alternative mitigations or workarounds are specified.