EUVD-2026-106281
GHSA-crhq-r385-g7jj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Internal Operations
-
ExecutionBypass authorization on HRMS (Norway) data
-
ImpactExfiltrate all accessible HR records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged authenticated account (PR:L) on an Oracle E-Business Suite deployment that has the HRMS (Norway) localization and its Internal Operations component installed and reachable over HTTP. Affected versions are 12.2.3 through 12.2.15. No user interaction is needed and attack complexity is low, but the authentication requirement and the Norway-specific module scope are the key limiting factors - instances without the Norwegian HRMS localization or without exposed HTTP access for low-privilege users are not realistically exploitable. |
| Impact | This is a moderate-severity, confidentiality-only flaw (CVSS 3.1 6.5) in the Internal Operations component of Oracle HRMS (Norway) within Oracle E-Business Suite. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding complete disclosure of all HRMS (Norway)-accessible data with no integrity or availability impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so no public exploit identified at time of analysis and no evidence of active exploitation exists. The practical priority is tempered by two factors: exploitation requires an authenticated foothold (PR:L), and the affected module is a Norway-specific HR localization with a limited deployment footprint. IMPORTANT CONFLICT: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which specifies PR:L (authentication required) - this is confidentiality disclosure by an already-authenticated low-privileged user, not an auth bypass; verify with Oracle's CPU advisory. Net assessment: a credible insider/low-privilege data-exposure risk worth patching in the Oct 2026 CPU cycle, but not an emergency given authentication prerequisites, no known exploitation, and narrow product reach. |
| Exploit ScenarioDerived | An attacker holding a low-privileged authenticated account on an Oracle E-Business Suite instance sends crafted HTTP requests to the Internal Operations component of the HRMS (Norway) module, abusing missing authorization checks to read HR data they should not be able to access. No user interaction or elevated privileges are needed, and the result is full disclosure of all HRMS (Norway)-accessible data. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthorized read access to critical HR data in Oracle HRMS (Norway) is possible for a low-privileged authenticated attacker who can reach the Internal Operations component over HTTP. The flaw affects Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that include the Norwegian HRMS localization, and successful exploitation yields high confidentiality impact without integrity or availability effects. No public exploit was identified at the time of analysis, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
RemediationAI
Apply the Oracle E-Business Suite remediation published in the October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the provided data does not include an exact fixed version, so verify the required patch level for Oracle HRMS (Norway) 12.2.3-12.2.15 in that advisory before upgrading. Until patched, restrict HTTP access to the HRMS (Norway) Internal Operations component to trusted networks or user groups, review and reduce low-privileged accounts that can reach the module, and monitor for anomalous data access; each restriction reduces exposure but can disrupt legitimate HR users, so scope it to business need. No public exploit was identified at the time of analysis, but the low attack complexity and authenticated low-privilege entry point make timely patching and access review important.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle HRMS (Norway) is a country-specific localization within Oracle E-Business Suite, and the affected Internal Operations component handles HR business operations exposed through the EBS application tier. The provided data does not include a CWE mapping, so the formal root-cause class is unclassified; the vendor tag 'Authentication Bypass' plus the CVSS vector (PR:L, C:H, no UI) indicates an access-control weakness that lets an already authenticated low-privileged user retrieve data beyond their intended authorization scope rather than a pre-authentication flaw. Affected deployments are EBS 12.2.3 through 12.2.15 with the Norway HRMS module installed and reachable over HTTP; no CPE strings were supplied to narrow the platform further.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no UI; PR:L because the description states a low-privileged (authenticated) attacker; confidentiality-only high impact, no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB