Oracle E-Business Suite CVE-2026-101669

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with HTTP network access to the Oracle Public Sector Human Resources module, specifically its 'Regression Testing' component, on affected EBS releases 12.2.3 through 12.2.15. Exploitation is further limited by high attack complexity (AC:H): the attacker must meet conditions or timing beyond their direct control, which is why Oracle describes it as 'difficult to exploit.' No end-user interaction is needed (UI:N), and no special non-default configuration is named in the advisory, but the authentication requirement and the AC:H barrier materially reduce real-world exploitability beyond what the network attack vector alone implies.

This is a moderate, authenticated-only risk that does not warrant emergency prioritization. The CVSS 3.1 base score of 6.8 (MEDIUM) reflects a genuinely constrained attack: AV:N gives network reach over HTTP, but AC:H indicates the attacker must win a race or satisfy conditions outside their control, and PR:L confirms valid low-privileged application credentials are required before any exploitation. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no signal of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The impact is real where it applies (C:H/I:H allowing unauthorized read and create/delete/modify of all data accessible to the Public Sector Human Resources module, which includes sensitive HR/PII records), but A:N means no availability impact and S:U means the blast radius is confined to the vulnerable component. One conflicting signal must be flagged: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS vector (PR:L requires authentication) and the description ('low privileged attacker') - this is almost certainly a mislabeled tag, not an auth-bypass flaw. Net: a credible but lower-priority insider/post-compromise threat rather than an internet-wide emergency; patch in the normal Oracle October 2026 CPU cycle.

An attacker who already holds a low-privileged Oracle E-Business Suite account (for example a routine self-service HR user or a compromised employee login) sends crafted HTTP requests to the Public Sector Human Resources 'Regression Testing' component to escalate their reach and read or tamper with HR data across the module. Because CVSS marks attack complexity as high (AC:H), the attacker must satisfy additional conditions or timing to succeed, and no public exploit code is known to exist, so this is more plausible as targeted insider or post-compromise abuse than mass exploitation.