Oracle E-Business Suite CVE-2026-101673

Exploitation requires a valid low-privileged account on the Oracle US Federal Human Resources application (PR:L) and network HTTP access to the Internal Operations component; it works against affected versions 12.2.3 through 12.2.15 without any user interaction (UI:N) or elevated privileges. The authentication requirement is the primary limiting factor - this is not remotely exploitable by anonymous internet attackers - so realistic risk is concentrated in environments where many users or external/federated identities can obtain even minimal application credentials. Impact is limited to disclosure of confidential HR data; the flaw cannot modify data or disrupt availability (I:N/A:N).

This is a moderate-severity confidentiality breach, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack over HTTP, but it explicitly requires a low-privileged authenticated account (PR:L) - so the attacker must already hold valid, if limited, credentials to the application. Impact is confidentiality-only (C:H, I:N, A:N): successful exploitation exposes critical or all Oracle US Federal Human Resources data, but does not allow data modification or denial of service, and scope is unchanged (S:U). No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified at time of analysis, so there is no positive signal of real-world exploitation; absence of these signals is not proof of safety but does lower immediate priority relative to a KEV-listed or high-EPSS flaw. One conflicting signal must be flagged: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS vector's PR:L (exploitation requires existing privileges, not a bypass of authentication) - verify the vulnerability class with Oracle before treating this as a pre-auth issue. Given the HR data sensitivity (likely PII of federal personnel) this warrants prompt patching in affected environments, but the authentication requirement and confidentiality-only impact place it below critical, pre-auth, or actively-exploited bugs in the patch queue.

A low-privileged user with a valid Oracle US Federal Human Resources account sends crafted HTTP requests to the Internal Operations component and leverages the flaw to read HR data belonging to other users or the entire application dataset. Because the attack is network-based with low complexity and no user interaction, any holder of a minimal application account could attempt it, though valid credentials are a prerequisite. No public exploit code was identified at time of analysis.