Oracle HRMS (India) CVE-2026-83359

Exploitation requires a valid low-privilege Oracle E-Business Suite account (CVSS PR:L) with network HTTP reachability to the Oracle HRMS (India) Indian Payroll component on a vulnerable instance (versions 12.2.3 through 12.2.15). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory pre-existing authentication is the key limiting factor - unauthenticated external attackers cannot exploit this directly. Practical risk is therefore bounded to environments that provision low-privilege EBS accounts to potentially untrusted users and expose the HRMS (India) HTTP interface to those users. The specific configuration, screen, or API that must be enabled is not detailed in the provided Oracle CPU reference.

This is a moderate-priority issue best characterized as an authenticated information-disclosure flaw rather than a critical breach vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 and is internally consistent with the description: network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L) - i.e., the attacker must already hold a valid, low-privilege EBS account. Impact is confidentiality-only (C:H, I:N, A:N), so successful exploitation exposes or fully reads HRMS (India) data but does not modify data or disrupt availability. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input. Notably, the input Tag 'Authentication Bypass' conflicts with the CVSS vector: PR:L explicitly requires authentication, so this is not a true authentication-bypass condition - verify tag accuracy. On balance this is a real but contained risk (credentialed insider or compromised low-priv account reading sensitive payroll data), not a high-urgency unauthenticated-RCE scenario; prioritize via normal Oracle CPU patch cadence unless you have untrusted low-privilege EBS users.

An attacker who already holds a low-privilege Oracle E-Business Suite account sends a crafted HTTP request to the Indian Payroll component of Oracle HRMS (India) and obtains unauthorized read access to sensitive payroll and HR data beyond their authorization. No public exploit code or active exploitation was identified in the provided data, and the attack requires no user interaction but does require valid credentials (PR:L).