Oracle HRMS CVE-2026-46953

Exploitation requires (1) a reachable Oracle E-Business Suite instance running HRMS (UK) / UK Payroll at version 12.2.3-12.2.15 with the HTTP interface accessible to the attacker, and (2) valid credentials for an account holding high HRMS/UK Payroll privileges (PR:H in the CVSS vector) - typical Self-Service Portal or read-only ESS users are not sufficient. No user interaction is required (UI:N) and scope is unchanged (S:U), but the PR:H gate limits exploitation to insiders, compromised admin/functional-super-user accounts, or attackers who first pivot through another EBS weakness to obtain high privileges. The vulnerability is in the UK Payroll module specifically, so EBS deployments that have not licensed or enabled UK Payroll are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2 (High) - full CIA impact but gated by PR:H, meaning the attacker must already hold high application privileges (e.g. an EBS administrative or functional super-user account). There is no EPSS value, no KEV listing, and no public POC indicated in the supplied intelligence, so realistic risk is lower than the raw 7.2 suggests for externally-facing exposure but materially higher for organisations where EBS admin credentials are broadly shared or weakly protected. Oracle's wording 'easily exploitable' refers to AC:L once privileges are held - not to a remote unauthenticated path. The 'Information Disclosure' tag is inconsistent with the C:H/I:H/A:H impact (which indicates full takeover, not mere disclosure); treat the tag as imprecise and rely on the CVSS impact metrics.

An attacker who has obtained an Oracle EBS account with high UK Payroll / HRMS privileges - for example a compromised payroll administrator credential or a malicious insider - sends a crafted HTTP request to the HRMS (UK) component and gains full control of the HRMS application, enabling payroll data theft, fraudulent payment modifications, or destructive changes to employee records. No public POC is available, so a real-world adversary would need to perform their own analysis of the patched code path once Oracle's June 2026 CPU is reverse-engineered.