EUVD-2026-106301
GHSA-xq4q-pp9w-rrvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Internal Operations
-
ImpactExfiltrate all accessible HRMS data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite / HRMS (US) user account (CVSS PR:L) with network HTTP access to the Internal Operations component, on affected versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated user can trigger it against default configurations. Limiting factors: exploitation is gated on authentication, restricting the attacker pool to credentialed insiders or those who have already obtained EBS credentials; impact is confined to confidentiality (no data modification or service disruption). |
| Impact | Signals are consistent but moderate. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity attack that nonetheless requires a low-privileged authenticated account and yields confidentiality-only impact (no integrity or availability loss). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' The one-year Oracle Critical Patch Update cadence and the fact this was vendor-reported (secalert_us@oracle.com) rather than observed in attacks both point to a patch-priority rather than an emergency item. CONFLICT TO VERIFY: the input Tags include 'Authentication Bypass,' but the CVSS vector specifies PR:L (a valid low-privileged account is required), which directly contradicts an authentication-bypass characterization - the description describes privileged data disclosure, not bypass, so the tag appears mislabeled. Net: a genuine but not top-tier priority - a confidentiality breach of sensitive HR data exploitable by any authenticated user, worth prioritizing in the normal CPU patch cycle but without the urgency a KEV/high-EPSS/unauthenticated flaw would carry. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has obtained such credentials) sends crafted HTTP requests to the Internal Operations component of Oracle HRMS (US). Because the flaw grants unauthorized access to critical data, the attacker reads or exfiltrates sensitive HR records (employee PII, compensation, etc.) beyond their authorization. No public exploit code is known at time of analysis, and exploitation requires authentication (PR:L), limiting it to insiders or credentialed attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged Oracle E-Business Suite users can read critical HRMS (US) data through the Internal Operations component, a confidentiality-only exposure reachable over HTTP. Oracle HRMS (US) releases 12.2.3 through 12.2.15 are affected by this easily exploited flaw (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning any valid authenticated EBS account can trigger it against a default configuration without user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical barrier remains obtaining valid EBS credentials - the attacker pool is limited to credentialed insiders or someone who has already compromised an account, and no data modification or service disruption is possible.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 as published at https://www.oracle.com/security-alerts/cpuoct2026.html; Oracle CPU advisories bundle the fix into the EBS patch set applied through the standard patching utility (adop/ADP and TXK), and no individual patch revision number is specified in the available data, so validate the exact patch against the advisory and your installed 12.2.x level before deployment. Because the vulnerable component is reachable over plain HTTP from the network, the highest-value interim control is closing exposure at the perimeter - restrict the EBS HTTP/HTTPS listener to VPN, allow-listed client ranges, or an authenticated reverse proxy, at the trade-off of breaking remote and mobile access for legitimate staff until they are on the tunnel. In parallel, audit and prune low-privileged EBS accounts, in particular any self-registered or shared accounts with default responsibilities that can reach HRMS (US) Internal Operations, since the exploit requires only a valid PR:L credential; this reduces the insiders-who-can-abuse-it population at the cost of user provisioning churn. Enforce MFA or SSO in front of EBS and rotate credentials for anyone who had access during the exposure window, and enable HTTP access logging and anomaly alerting on HRMS (US) Internal Operations page requests - watching for enumeration-style browsing sequences - to catch post-compromise reads that the patch itself will not surface. Unscheduled extended support or legacy environments unable to take the CPU should be treated as accepted-risk exposures with compensating network segmentation rather than left internet-reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's ERP application stack, and its HRMS (US) module stores payroll, benefits, and personally identifiable employee data for US localization. The affected surface is the Internal Operations component, which is reached over HTTP by ordinary application sessions rather than through a dedicated protocol daemon. Oracle does not publish a CWE mapping for this CPU entry, so the precise root-cause class (for example an authorization or access-control gap versus an input-handling defect) is not confirmed in the available data; what the assessed vector establishes is that once an attacker holds a low-privileged EBS session, the application performs insufficient restriction on what HRMS (US) Internal Operations data can be read. Because the attack requires only network reachability to the EBS HTTP listener, low complexity, and no user interaction (AV:N/AC:L/UI:N), the control that actually gates exploitation is the credential itself (PR:L), not any memory-safety or configuration hardening precondition. Impact is scored as high confidentiality with no integrity or availability effect, consistent with a read-only data exposure rather than a query or code-execution primitive. The affected release window 12.2.3-12.2.15 spans most of the supported 12.2.x line, per the EUVD entry and Oracle's October 2026 Critical Patch Update advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no user interaction, but a valid low-privileged account is required (PR:L); impact is confidentiality-only, so I:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB