EUVD-2026-47443
GHSA-7fpw-p3gg-6m84
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network delivery via HTTP with no attacker privileges aligns with PR:N; victim interaction required (UI:R); limited read/write impact, no availability loss.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS (Republic of Korea). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Republic of Korea) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Republic of Korea) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Technical ContextAI
The vulnerability resides in the Korean Payroll component of Oracle E-Business Suite's HRMS module (Oracle HRMS Republic of Korea), a country-specific HR and payroll management application. The affected version range is 12.2.3 through 12.2.15, delivered over HTTP per the CVSS AV:N vector. No CWE is formally assigned in the NVD entry, but the 'Authentication Bypass' tag combined with UI:R and PR:N strongly suggests a client-side trust violation - likely cross-site request forgery (CSRF) or reflected XSS - that causes a victim's authenticated session to perform unintended data operations. The scope is unchanged (S:U), meaning impact is confined to the Korean HRMS application itself rather than cascading to adjacent Oracle EBS components.
RemediationAI
Apply the patch provided in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle has not disclosed the specific patched version number in the public advisory text; organizations should consult My Oracle Support and the CPU documentation to confirm the exact patch ID applicable to their EBS release. If immediate patching is not feasible, restrict network-level access to the Korean Payroll component to trusted internal networks only, reducing the attack surface for the network-delivered (AV:N) exploit vector. Additionally, enforce strict referrer-header and anti-CSRF token controls at the web application firewall or EBS application layer if the root cause is confirmed as CSRF - note this workaround is unverified without full vendor disclosure. No patch version number can be independently confirmed from available data beyond the July 2026 CPU reference.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today