Oracle iRecruitment CVE-2026-61064

Exploitation requires a valid, low-privileged account on the Oracle E-Business Suite instance with network HTTP access to the iRecruitment application (CVSS PR:L, AV:N). The vulnerable component is 'Install / Upgrade Issues,' suggesting the flaw may be present in setup or migration-related endpoints that are accessible during or after deployment of supported versions 12.2.3 through 12.2.15. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning the exploit path is consistent and does not depend on race conditions or environmental factors. Exploitation is strictly limited to authenticated users - unauthenticated external attackers cannot exploit this vulnerability directly per the CVSS PR:L metric. The 'Authentication Bypass' EUVD tag likely describes intra-application authorization bypass (bypassing role-based access controls post-login), not pre-authentication access; this limits exploitation to insiders, contractors, or holders of compromised EBS credentials.

The CVSS 3.1 score of 5.4 (Medium) reflects a network-accessible, low-complexity flaw requiring low privileges and no user interaction - signals that place this above typical medium-risk issues in practice. The attack vector (AV:N/AC:L/PR:L/UI:N) means any valid EBS account holder can attempt exploitation without specialized knowledge or tooling. Impact is limited to partial confidentiality (C:L) and integrity (I:L) - no availability impact - which bounds the damage to data exposure and unauthorized modification of recruitment records (e.g., candidate PII, job requisitions, hiring decisions). No EPSS data was provided, making quantitative exploitation probability unavailable. The absence of KEV listing and no identified POC suggest this has not been broadly weaponized, but the low complexity and broad authenticated user pool in enterprise deployments elevate realistic risk above the raw score implies. The 'Authentication Bypass' tag conflicts slightly with PR:L - if this were a true auth bypass from unauthenticated state, PR:N would be expected; the tag likely describes intra-application authorization bypass post-login, not pre-authentication bypass. Security teams should verify this distinction with the Oracle advisory.

An attacker with a low-privileged Oracle E-Business Suite account - such as a job applicant self-service account, a contractor, or a compromised employee credential - sends crafted HTTP requests to the iRecruitment Install/Upgrade component, triggering an authorization control flaw that grants access to recruitment data or modification capabilities beyond their assigned role. The low attack complexity means no specialized tooling or exploit framework is needed; standard HTTP request manipulation suffices. No public proof-of-concept has been identified at time of analysis.