Oracle iRecruitment CVE-2026-61025

Exploitation requires an authenticated, high-privileged iRecruitment/EBS account (CVSS PR:H) with network access to the application over HTTP; it targets the Internal Operations component of Oracle iRecruitment on E-Business Suite versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory high-privilege prerequisite is the key limiting factor - this cannot be exploited by an unauthenticated or low-privileged actor and is therefore realistically an insider or post-credential-compromise attack rather than an anonymous internet-facing one. Deployments outside the 12.2.3-12.2.15 range or without iRecruitment enabled are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) shows a network-reachable, low-complexity attack requiring no user interaction but requiring high privileges (PR:H) - meaning the attacker must already hold an elevated iRecruitment/EBS account, which materially limits the realistic threat population to insiders or attackers who have already compromised a privileged credential. No EPSS score, POC, or KEV entry was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. No CWE and no SSVC decision data were supplied. The signals are internally consistent: the 7.2 score is driven by full CIA takeover impact, not by ease of initial access. This is a genuine priority for organizations running EBS 12.2.x because the impact is total module compromise, but the PR:H prerequisite means it is not a mass-exploitable, unauthenticated internet threat - treat it as a high-value insider/post-compromise risk rather than a perimeter emergency.

A malicious insider or an external attacker who has already phished or stolen a privileged iRecruitment/EBS account credential sends crafted HTTP requests to the Internal Operations component of a 12.2.x iRecruitment instance. Because the attack is low-complexity and needs no user interaction, they leverage their elevated privileges to take over the iRecruitment module, exfiltrating or altering applicant and internal HR data and disrupting the service. No public proof-of-concept is known at time of analysis, so exploitation would require independent development.