Oracle HRMS (UK) CVE-2026-83371

Exploitation requires the attacker to possess a valid low-privileged account on the target Oracle HRMS (UK) / E-Business Suite instance (PR:L) with network HTTP reachability, and critically depends on a separate, typically higher-privileged user being tricked into interacting with attacker-supplied content (UI:R) - consistent with a stored XSS or CSRF-style flaw in the Internal Operations component. Limiting factors that reduce real-world risk: valid authentication is mandatory (no unauthenticated path despite the misleading tag), victim interaction by a second person is required, and only versions 12.2.3 through 12.2.15 are affected; impact is bounded to partial read plus partial update/insert/delete with no availability loss, though the scope change can carry effects into other EBS products.

This is a medium-severity issue (Oracle/NVD CVSS 3.1 base 5.4, vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rather than a top-priority emergency. The vector shows network access over HTTP with low attack complexity, but two meaningful brakes apply: the attacker must already hold a low-privileged authenticated account (PR:L) and must induce interaction from a different user (UI:R). Impact is partial - low confidentiality and low integrity, no availability - though the scope change (S:C) and the description's note that 'attacks may significantly impact additional products' raise the ceiling beyond the HRMS module itself. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable near-term exploitation; this reads as a classic authenticated, interaction-dependent EBS web flaw (the UI:R + S:C + C:L/I:L shape is characteristic of stored XSS/CSRF) rather than a wormable or mass-exploited bug. Note a conflict in the input: the 'Authentication Bypass' tag contradicts the official vector's PR:L (which requires valid credentials) - verify the true vulnerability class with Oracle, as this is not an unauthenticated bypass per the CVSS data.

A low-privileged user with a valid Oracle E-Business Suite / HRMS (UK) account plants a crafted payload into an application field and then lures a higher-privileged user into viewing it, causing actions or data access to execute in the victim's context. Because the scope changes, the impact can extend to other EBS products beyond HRMS. No public exploit code was identified in the provided intelligence.