EUVD-2026-47506
GHSA-v54m-4hp3-9939
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Authenticated data compromise in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite 12.2.14–12.2.15) lets a low-privileged user with logon access to the hosting infrastructure read, create, delete, or modify all data the HR application can reach. Oracle rates it CVSS 3.1 7.1 with High confidentiality and integrity impact and no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Human Resources gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Human Resources executes to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
A data compromise vulnerability in Oracle E-Business Suite 12.2.14-12.2.15's Enterprise Command Center component allows low-privileged users with system access to read, create, delete, and modify all HR application data, including employee records and sensitive compensation information. This affects organizations using these Oracle HR versions and exposes critical workforce data to internal threat actors and compromised accounts.
Within 24 hours, identify and audit all Oracle E-Business Suite 12.2.14-12.2.15 deployments with the HR module enabled and document which users have logon access to the hosting infrastructure. Within 7 days, apply Oracle Critical Patch Update July 2026 to all affected systems in a staging environment, verify functionality, and plan production rollout. Within 30 days, deploy the patch to all production Oracle E-Business Suite HR systems and audit access logs for unauthorized HR data access during the window before patching.
Apply vendor patch: Oracle Critical Patch Update July 2026. Until patched, restrict logon access to the hosting infrastructure to only personnel requiring direct administrative access and monitor HR data access logs for unauthorized queries or modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Human Resources
View allUmanni RH 1.0 does not limit the number of authentication attempts. Rated critical severity (CVSS 9.8), this vulnerabili
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Rated
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Rated
Umanni RH 1.0 has a user enumeration vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exp
Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Rate
Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Rate
Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Comm
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: People Management). Rated hig
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). Rated high sev
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Rated
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Rated
Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 1
Exploit-DB