Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.
Insecure file creation in the Perl CPAN module Data::Graph::Shared before version 0.04 exposes inter-process communication (IPC) payloads to any local user on the system. The mmap backing file used for shared memory segments is created with permissions 0666 (effectively 0644 after umask), making stored IPC data world-readable in shared directories such as /tmp or /dev/shm. Two additional missing flags - O_EXCL and O_NOFOLLOW - allow a local attacker to either win a pre-creation race to substitute their own file or plant a symlink to redirect the open call. No public exploit code has been identified and EPSS is 0.16% (6th percentile), consistent with limited real-world exploitation interest.
World-readable shared memory segments in Data::NDArray::Shared before 0.02 expose IPC payloads to any local user on the system. The module's ndarray.h creates mmap backing files in shared directories such as /tmp or /dev/shm with effective permissions 0644 (world-readable under umask 022) and omits both O_EXCL and O_NOFOLLOW from the open call, enabling passive eavesdropping on shared memory contents and a pre-creation race or symlink-redirect attack by any unprivileged local account. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability; risk is concentrated in multi-tenant or shared-hosting environments where untrusted local users coexist with processes passing sensitive data through this module.
Local partial denial-of-service in Oracle GoldenGate Stream Analytics 26.1.0.0.0 allows a low-privileged attacker with logon access to the host infrastructure to degrade availability of the analytics service. The vulnerability resides in the Security component and requires no user interaction once local access is established. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.3 reflects a limited, non-critical impact confined to availability.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Cross-origin information disclosure in Google Chrome prior to 150.0.7871.182 allows a remote attacker who has already compromised the renderer process to leak sensitive data from other origins via a crafted HTML page. The vulnerability arises from an uninitialized use in the Skia graphics library. Exploitation is unlikely given high complexity and the prerequisite of a separate renderer compromise; no active exploitation or public exploit has been identified at the time of analysis.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Signed integer overflow in libarchive's ZIP writer (`archive_write_zip_header` in `archive_write_set_format_zip.c`) produces undefined behavior when ZIP encryption is enabled and a file entry size approaches INT64_MAX, causing the encryption overhead addition to wrap the int64_t type. The resulting undefined behavior may cause incorrect Zip64 extension logic - producing malformed archive structure - or, in worst-case scenarios, memory corruption that could affect availability of the consuming process. No public exploit or active exploitation has been identified; the CVSS score of 2.9 and high attack complexity reflect extreme trigger conditions that are practically unreachable in normal deployments.
Partial denial-of-service exposure in Oracle Agile Engineering Data Management 6.2.1 allows a local, low-privileged attacker to degrade availability of the Install component when a separate user interacts with the system. The CVSS 3.1 base score of 2.8 reflects the constrained impact: only availability is affected, no confidentiality or integrity loss occurs, and exploitation is bounded by local access and mandatory human interaction from a third party. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data manipulation in Oracle Database Server's RDBMS component allows a highly privileged, network-connected attacker to perform insert, update, or delete operations against a subset of data accessible within the database. Affected versions span the 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2 release trains, all reachable over Oracle Net without user interaction. No public exploit has been identified at time of analysis; with a CVSS 3.1 score of 2.7 and integrity-only impact, the risk is primarily relevant to environments where high-privileged database credentials may be compromised or misused.
UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.
Null pointer dereference in Gitea's AddTime API (versions prior to 1.27.0) allows an authenticated repository administrator to crash the server by specifying a non-existent username in a time-tracking request. The root cause is a missing `return` statement in `routers/api/v1/repo/issue_tracked_time.go` after `GetUserByName()` returns an error, causing `AddTime()` to dereference a nil user pointer and trigger a Go runtime panic. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept is embedded in the GHSA advisory, making the issue trivially reproducible by any repository administrator.
Cross-repository label-ID enumeration oracle in Gitea through v1.26.3 allows any authenticated user with write:issue permission on any repository to probe label ID existence across all repositories and organizations on the instance - including private ones they cannot access. The flaw arises because the DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} API handler performs a global, unscoped label lookup and leaks existence via differential HTTP status codes (204 vs. 422). No label names, colors, repository associations, or content are disclosed, and no cross-repository writes occur; however, a working proof of concept was verified against v1.26.3 and a fix is available in v1.27.0. No public exploit identified at time of analysis beyond the verified PoC in the advisory.
Partial availability disruption in Oracle Siebel CRM End User (Redwood UI component, versions 24.4 through 26.3) can be triggered by a highly privileged network attacker over HTTP under difficult exploitation conditions that also require victim interaction, potentially causing cascading availability degradation in interconnected systems due to a confirmed scope change. The CVSS 3.1 base score of 2.6 (Low) reflects the extremely restrictive prerequisite chain - high privileges, user interaction, and high attack complexity must all align. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthorized partial data read in Oracle Siebel CRM Deployment (Application Interface component) is achievable by low-privileged, network-adjacent authenticated attackers over HTTP across versions 17.0 through 26.4. Exploitation is difficult due to high attack complexity and a mandatory human-interaction requirement, limiting exposure to targeted scenarios rather than opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis; the low CVSS score of 2.6 reflects the constrained, confidentiality-only impact.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.