EUVD-2026-106226
GHSA-3x58-h3cr-4r9r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliveryReach HCM Internal Operations over HTTP
-
ExploitSatisfy high-complexity precondition
-
ExecutionExploit flaw in HCM Common Architecture
-
ImpactRead/modify/delete critical HCM data and degrade availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account (PR:L) on Oracle HCM Common Architecture within Oracle E-Business Suite versions 12.2.3 through 12.2.15, with network HTTP access to the Internal Operations component. Exploitation is limited by HIGH attack complexity (AC:H): the attacker must satisfy a specific precondition or environmental factor not controlled by them (e.g., timing/race or configuration-dependent state) that makes reliable exploitation difficult. No end-user interaction is needed (UI:N), and scope is unchanged (S:U), confining impact to the HCM component's accessible data. The practical limiting factors are the authenticated-account prerequisite and the high complexity, which together make opportunistic mass exploitation unlikely. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.1 (High) is driven by strong impact metrics (C:H/I:H/A:L) rather than ease of access: the vector AV:N/AC:H/PR:L/UI:N shows network reachability but with HIGH attack complexity and a requirement for an already-authenticated low-privileged account. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public POC referenced, so no public exploit identified at time of analysis. The combination of AC:H plus PR:L meaningfully depresses real-world exploitability compared to a network-facing unauthenticated flaw, suggesting this is a high-impact-but-conditional issue rather than a mass-exploitation candidate. Note a tagging conflict: the input Tags include 'Authentication Bypass', which contradicts the CVSS requirement for valid low-privileged authentication (PR:L) - treat the auth-bypass label as suspect and rely on the CVSS vector, which indicates an authenticated attacker. Because this is drawn from the Oracle October 2026 Critical Patch Update, prioritize patching for internet-exposed EBS instances where low-privileged accounts are broadly provisioned. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged application account on an internet-reachable Oracle E-Business Suite instance sends crafted HTTP requests to the HCM Common Architecture Internal Operations component, overcoming the high-complexity conditions to read, modify, or delete critical HCM data and degrade availability. No public exploit code is known, and the high attack complexity (AC:H) implies the attacker must win a race, defeat a specific precondition, or possess particular environmental knowledge to succeed reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.
RemediationAI
Primary fix: apply the Oracle October 2026 Critical Patch Update for Oracle E-Business Suite, which is the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html and covers HCM Common Architecture in 12.2.3 through 12.2.15; use Oracle's standard EBS patching path (adop/Online Patching cycles) and verify the HCM Common Architecture patches listed in the CPU are applied to the application tier, not just the database tier. Where patching must be staged, compensating controls with real effect are: restrict network reachability to the EBS application tier so that only expected user populations and trusted integration hosts can reach the HTTP endpoints used by Internal Operations (implemented via firewall ACLs or an authenticating reverse proxy), with the trade-off that legitimate remote or mobile HCM users and partner integrations must be re-homed or allow-listed first; aggressively review and reduce low-privileged HCM/EBS account assignments and shared credentials, since PR:L is a hard prerequisite, accepting the operational overhead of tighter onboarding; and enable EBS audit/access logging plus database audit policies on HCM tables to detect anomalous create/update/delete activity from low-privilege sessions, noting the storage and performance cost of full audit trails. Because the flaw is an authentication/authorization bypass within the application rather than a network-service misconfiguration, blocking individual ports is not a durable mitigation and would break EBS functionality; the CPU patch remains the only complete remediation. No vendor-released patch version string beyond the CPU identifier was present in the intelligence feed, so confirm exact patch numbers in the Oracle advisory before scheduling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the HCM Common Architecture layer of Oracle E-Business Suite, the shared runtime and business-logic scaffolding that Oracle's Human Capital Management modules (Core HR, Payroll, Self-Service, and dependent Oracle Application Framework pages) build upon. The vulnerable surface is the 'Internal Operations' component, which is invoked over HTTP and therefore sits behind the standard EBS web tier (Oracle HTTP Server / application middle tier) rather than requiring direct database connectivity. Oracle assigns no CWE here, but the vendor's supplied tags - Authentication Bypass, Denial Of Service - indicate a weakness in how internal HCM operations validate the caller's authorization context: a session holding only low-privileged credentials can reach internal operations that should be reserved for higher-trust accounts or trusted server-side calls. Because the CVSS vector is PR:L with AC:H, the attacker must already hold a valid low-privilege account and must additionally satisfy an environment-dependent precondition (for example a particular configuration state, sequence, or timing/race condition) before the authorization check can be bypassed. Integrity and confidentiality impacts are High (arbitrary create/delete/modify and full read access to HCM Common Architecture data within scope), while availability is only Low, consistent with a partial denial of service rather than a full outage. Scope is Unchanged, so the compromise is confined to the HCM component's accessible data and does not formally cross a trust boundary into other EBS products.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Network HTTP vector (AV:N) but AC:H for the stated difficult-to-exploit precondition, PR:L for the required low-privileged account; high C/I impact and only partial DOS yields A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
Executive ViewAI
Oracle HCM Common Architecture in Oracle E-Business Suite 12.2.3 through 12.2.15 presents a high-severity risk to organizations running HCM on that platform because a low-privileged authenticated user could read or modify critical HR data and partially disrupt service availability. Leadership should prioritize this behind unauthenticated, low-complexity exposures, but still treat it as a material HR data-integrity and availability issue: no public exploit has been identified at time of analysis and it is not in CISA KEV, while exploitation requires a difficult precondition and valid low-privileged access.
No vendor-released patch identified at time of analysis; interim mitigations include restricting HTTP reachability of the Internal Operations component, enforcing least privilege and monitoring low-privileged HCM accounts, deploying WAF/virtual patching and network segmentation, auditing HCM data changes, and applying the Oracle October 2026 Critical Patch Update fix once confirmed and validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB