Oracle HRMS CVE-2026-83391

Exploitation requires (1) a valid low-privilege Oracle E-Business Suite / HRMS (US) account to reach the US Payroll Year End component over HTTP (PR:L, AV:N), and (2) human interaction from a different, typically higher-privileged user who must view or process the attacker-supplied data (UI:R) for the payload to trigger. Affected deployments are Oracle HRMS (US) versions 12.2.3 through 12.2.15. Limiting factors: no unauthenticated path, mandatory victim interaction, and only partial confidentiality/integrity impact with no availability impact, which collectively reduce realistic exploitability below the raw network-vector reading.

This is a moderate-severity (CVSS 3.1 5.4) vulnerability in the US Payroll Year End component of Oracle HRMS (US) within Oracle E-Business Suite. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity flaw that requires an already-authenticated low-privileged attacker (PR:L) AND human interaction from a different user (UI:R), with a scope change (S:C) and only partial confidentiality/integrity impact and no availability impact. This profile - PR:L + UI:R + S:C + C:L/I:L/A:N - is the textbook signature of a stored/reflected cross-site scripting (XSS) issue in Oracle EBS, where an authenticated attacker injects content that executes in a victim user's session, which is why scope changes beyond the vulnerable component. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is moderate rather than urgent: the dual requirement of valid low-privilege credentials and victim interaction materially lowers the practical attack likelihood compared to an unauthenticated RCE. The 'Authentication Bypass' tag conflicts with the CVSS data - PR:L explicitly requires authentication, and nothing in the description indicates auth bypass; treat that tag as likely mislabeled and verify against Oracle CPU October 2026.

An attacker with a valid low-privilege Oracle EBS account injects a malicious payload into a US Payroll Year End input field or workflow; when a higher-privileged HR/payroll user later views that data in their browser, the payload executes in their authenticated session, enabling unauthorized reads and limited insert/update/delete of HRMS data. The scope change (S:C) reflects impact crossing from the attacker's context into the victim user's session and adjacent EBS components. No public proof-of-concept is identified at time of analysis.