Oracle HRMS EUVD-2026-106295

Exploitation requires (1) the attacker to hold valid low-privilege authenticated access to Oracle HRMS (US) within the Mobile Applications component (PR:L), and (2) human interaction from a separate victim who must view or act on attacker-controlled content (UI:R) - the attacker cannot complete the attack alone. These two factors (mandatory authentication plus required victim interaction) are the primary limiting conditions that reduce real-world risk below the raw network-reachable vector. Affected deployments are Oracle E-Business Suite releases 12.2.3 through 12.2.15; systems outside this range or already patched via the October 2026 CPU are not exploitable.

This is a moderate-severity (CVSS 3.1 base 5.4, MEDIUM) vulnerability in Oracle HRMS (US), part of Oracle E-Business Suite, disclosed in the Oracle Critical Patch Update of October 2026. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) signals a network-reachable but privilege- and interaction-gated flaw: the attacker must already hold low-level authenticated access (PR:L) and must induce a separate victim to act (UI:R), while the scope change (S:C) plus partial confidentiality and integrity impact with no availability impact is the classic fingerprint of a stored/reflected cross-site scripting or similar injection issue rather than an authentication bypass. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence set, so there is no positive signal of active or imminent exploitation; the moderate CVSS is driven by impact scope and ease of access, not by demonstrated weaponization. Net assessment: a real but not top-priority issue for most defenders - patch in the normal CPU cycle rather than emergency-out-of-band - with the caveat that EBS is a high-value target and the required 'low privilege' is often trivially obtainable via self-service HR portals. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (an authenticated low-privilege attacker) - this is not an unauthenticated bypass; verify the vulnerability class against the Oracle advisory.

A low-privileged authenticated EBS user (e.g. an employee with self-service HR access) injects a malicious payload through the Mobile Applications component of Oracle HRMS (US). When a different, more privileged user - such as an HR administrator - views the affected content, the payload executes in their authenticated session, allowing limited unauthorized read and update/insert/delete access to HRMS data and potentially impacting other EBS products due to the scope change. No public exploit identified at time of analysis.