Oracle HCM CVE-2026-70773

No special configuration or authentication is required - the vulnerability exists in the default deployment of Oracle HCM Common Architecture 12.2.3-12.2.15 when the Knowledge Integration component is active and the E-Business Suite HTTP interface is network-reachable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, no elevated privileges, no user interaction, and no unusual configuration prerequisite. The primary limiting factor is network exposure: organizations that have isolated Oracle E-Business Suite HCM HTTP interfaces behind strict network controls or VPN are substantially less exposed than those with internet-facing or broadly intranet-accessible deployments. The attack is HTTP-only; HTTPS termination does not mitigate the authentication bypass at the application layer.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) scores 8.2 and aligns tightly with the description: network-reachable, no complexity barrier, no credentials, no user interaction required. Oracle's own characterization as 'easily exploitable' reinforces the low attack complexity rating. The combination of unauthenticated access, HTTP reachability, and high confidentiality impact against an HCM system - which routinely holds payroll, personal employee data, benefits, and performance records - elevates real-world priority beyond the raw score. No EPSS score was provided in the input, and the vulnerability is absent from CISA KEV at time of analysis, meaning exploitation in the wild is not confirmed. However, the attack surface profile (AV:N/AC:L/PR:N) means that if a working exploit emerges, mass exploitation would be trivial to automate. The integrity impact is limited (I:L), and availability is unaffected (A:N), which partially constrains the blast radius but does not reduce the data-theft risk. Organizations exposing Oracle E-Business Suite HCM interfaces to untrusted networks should treat this as high priority.

An unauthenticated external attacker identifies an Oracle E-Business Suite deployment with HCM modules accessible over HTTP and sends a crafted HTTP request to the Knowledge Integration component, bypassing authentication enforcement to retrieve complete employee records, payroll data, or other sensitive HCM data. The attacker can additionally manipulate some HCM data (insert/update/delete) with the same unauthenticated request. No public exploit code has been identified, but the low-complexity, no-auth attack profile means exploitation requires minimal technical sophistication once the endpoint is located.