Oracle iRecruitment CVE-2026-61026

Exploitation requires network HTTP access to an Oracle iRecruitment instance running an affected release (EBS 12.2.3-12.2.15) with the Internal Operations component reachable - in practice an exposed or reachable iRecruitment web front end. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction prerequisites, so any reachable affected instance is exploitable against default configurations. Limiting factors: the target must actually be network-reachable to the attacker (internet-facing portals are highest risk; internal-only or VPN-gated deployments substantially limit exposure), the instance must be an affected 12.2.x version, and impact is confined to reading iRecruitment-accessible data (no write or availability impact).

The signals are moderately concerning but incomplete. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case entry conditions: remotely reachable, no authentication, no user interaction, low complexity - meaning any exposed instance is trivially reachable. Impact is bounded to confidentiality (C:H, I:N, A:N), so this is a data-exposure issue, not RCE or destruction, which is why the score is 7.5 rather than critical. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from this feed; the 'Authentication Bypass' tag suggests high exploitability if an instance is internet-facing. Real-world priority hinges on exposure: an internet-facing iRecruitment candidate portal is a genuine priority, whereas an internal-only EBS deployment is materially lower risk. Note a tension worth verifying: the tag says 'Authentication Bypass' while the CVSS models pure confidentiality with no integrity impact - confirm with Oracle whether the bypass yields only read access or broader session control.

An attacker scans the internet for exposed Oracle iRecruitment candidate portals, then sends crafted unauthenticated HTTP requests to the Internal Operations component to bypass authentication and retrieve applicant or recruitment data such as candidate PII and internal records. No user interaction or credentials are required, so the attack can be automated across many EBS hosts; no public proof-of-concept has been identified at time of analysis.