EUVD-2026-106303
GHSA-7w7w-v373-qc3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged HRMS account
-
ExploitSend crafted HTTP request to Internal Operations
-
ExecutionBypass data access controls
-
ImpactExfiltrate sensitive HR data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker to hold valid low-privileged credentials on the Oracle HRMS (US) application (PR:L) and network HTTP access to the Internal Operations component; affected supported versions are Oracle E-Business Suite HRMS 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the authentication requirement - exploitation is not possible by a fully unauthenticated remote attacker - and impact is confined to confidentiality (unauthorized read of HRMS-accessible data) with no integrity or availability effect. |
| Impact | This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring only low-level authenticated privileges and no user interaction, yielding high confidentiality impact but no integrity or availability impact. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of PR:L plus confidentiality-only impact places real risk below that of an unauthenticated RCE: an attacker must already hold valid low-privileged credentials on the HRMS application, which limits opportunistic mass exploitation but is realistic for insider threats or compromised low-tier accounts. One conflicting signal must be noted: the input Tags label this 'Authentication Bypass,' which directly contradicts the CVSS PR:L requirement for existing privileges - the vector describes privilege escalation/data exposure by an authenticated user, not an auth bypass; verify tag accuracy with Oracle's CPU advisory. Because the data is a pre-publication-style Oracle CPU entry with no EPSS/KEV/POC, treat exploitation likelihood as currently low-to-moderate and driven by credentialed access. |
| Exploit ScenarioDerived | A low-privileged user with valid Oracle E-Business Suite / HRMS credentials sends crafted HTTP requests to the Internal Operations component and reads sensitive HR data (e.g., employee PII, compensation) they should not be authorized to access. No user interaction or elevated privileges are required beyond the initial low-level account. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthorized read access to HR data in Oracle HRMS (US) 12.2.3 through 12.2.15 is possible through an access-control weakness in the Internal Operations component of Oracle E-Business Suite, allowing a low-privileged authenticated user with HTTP network reach to retrieve records well beyond their intended authorization scope. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning impact is confined to confidentiality - no data modification or service disruption - and exploitation still requires valid credentials, which is the primary limiting factor. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not available in the supplied intelligence, so it should be treated as a moderate-priority patching item rather than an emergency.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's authoritative remediation channel for this CVE; Oracle CPU advisories bundle the specific patchset/ADOP cycle and any required prerequisite patches, and the supplied data does not disclose a discrete fix version beyond that advisory. Because exploitation requires only low-privileged credentials, interim compensating controls should focus on reducing the authenticated attack surface: restrict HTTP access to the EBS Internal Operations and HRMS (US) endpoints at the reverse proxy/WAF layer to trusted internal subnets or VPN-only users (side effect: legitimate remote HR staff lose direct access and must use VPN), tightly audit and minimize the population of low-privileged HRMS accounts and remove dormant users (side effect: helpdesk load during recertification), and enable verbose HTTP access logging with alerting on unusual enumeration patterns against HRMS (US) pages (side effect: log volume and storage growth). Network segmentation between the application tier and the database should be reviewed so that a compromised HRMS session cannot pivot beyond the EBS schema. Monitor the Oracle advisory page for patch availability confirmation and follow Oracle's standard ADOP patch application procedure during a maintenance window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite's HRMS (US) module is a set of database-backed application tiers (Oracle Forms, OAF/HTML self-service pages, and PL/SQL APIs) exposed through the EBS application server over HTTP/HTTPS, with business logic running under shared application schema privileges. The Internal Operations component handles back-office HR processing, and the reported weakness is an authorization/access-control defect in that layer that fails to enforce the caller's privilege boundary on certain operations - a class consistent with CWE-284 (Improper Access Control) or CWE-639 (Authorization Bypass Through User-Controlled Key), although no CWE was formally assigned in the supplied data. Because the application tier typically connects to the database with broad schema rights, a flaw at the application authorization layer can expose any HRMS (US) data reachable by that schema, which is why Oracle scores confidentiality as High while integrity and availability remain unaffected. The CVSS vector confirms network-reachable, low-complexity exploitation (AV:N/AC:L) with no user interaction (UI:N) and unchanged scope (S:U), gated only by the requirement for a low-privileged authenticated session (PR:L) - despite the 'Authentication Bypass' tag in the source metadata, the assessed vector indicates privilege escalation within an authenticated context rather than fully unauthenticated access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP access with low attack complexity and no UI; PR:L because a low-privileged authenticated account is required; confidentiality-only high impact, no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB