Oracle HR Intelligence CVE-2026-46971

Attacker must have network reachability to the Oracle E-Business Suite HTTP tier and a valid low-privileged EBS account (PR:L) on an installation running HR Intelligence on EBS 12.2.3 through 12.2.15 with the Internal Operations component enabled; no user interaction is required (UI:N). Exploitation is explicitly rated difficult (AC:H), implying timing, configuration, or multi-step conditions that limit reliable mass exploitation. Deployments where EBS is segmented to an internal network or where HR Intelligence is not licensed/enabled are correspondingly out of scope.

The CVSS 3.1 base score of 7.5 is driven by full C/I/A impact (H/H/H) and network reach (AV:N), but is tempered by AC:H and PR:L, meaning the attacker must already hold a low-privilege EBS account and overcome non-trivial exploitation conditions. The vulnerability is not in CISA KEV, no EPSS score was supplied, and no public exploit identified at time of analysis, so this is currently a patch-on-normal-CPU-cycle issue rather than an emergency. Risk rises sharply, however, for organisations that expose EBS to the internet or have weak HR/self-service account provisioning, since 'takeover of Oracle HR Intelligence' implies access to highly sensitive employee data. Note that no CWE was supplied and Oracle CPU descriptions are intentionally terse, so the precise attack technique is UNKNOWN from the provided data.

An attacker who has phished or otherwise obtained a low-privilege Oracle EBS account (for example, an employee self-service login) sends crafted HTTP requests to the HR Intelligence Internal Operations endpoints exposed by the EBS application server. By chaining the difficult-to-trigger flaw, the attacker escalates within the HR Intelligence module and exfiltrates or tampers with sensitive employee records and HR analytics. No public proof-of-concept is referenced in the provided data.