EUVD-2026-106302
GHSA-mv3q-9p57-h524
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
ExploitReach HRMS Internal Operations over HTTP
-
ExecutionSend crafted request exploiting access flaw
-
ImpactRetrieve unauthorized HRMS confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated account (PR:L) on an Oracle E-Business Suite deployment running Oracle HRMS (US) versions 12.2.3 through 12.2.15, with the Internal Operations component reachable over HTTP/HTTPS. No special non-default feature or user interaction is needed and attack complexity is low, but the authentication requirement limits exposure to users who can already log in to EBS; instances not exposing the HRMS HTTP interface to untrusted users, or already patched to a fixed level, are not exploitable. Impact is confined to unauthorized disclosure of HRMS data (no data modification or service disruption). |
| Impact | This is a moderate-severity confidentiality issue (CVSS 3.1 base 6.5) in Oracle HRMS (US) within Oracle E-Business Suite, scored AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable over HTTP, low attack complexity, but requiring low-level privileges (an authenticated EBS account), no user interaction, unchanged scope, and impacting confidentiality only (C:H, I:N, A:N). There is no public exploit identified at time of analysis, no EPSS score provided, and no CISA KEV listing, so there are no signals of active or imminent widespread exploitation - the risk is primarily unauthorized read access to HRMS data by an already-authenticated low-privilege user rather than remote unauthenticated takeover. A notable conflict exists in the metadata: the input carries an 'Authentication Bypass' tag, yet both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate exploitation requires valid credentials, not a bypass of authentication - this tag should be verified and treated as likely mislabeled. Because HRMS stores sensitive personnel/payroll data, the C:H rating is credible, but the requirement for authenticated access and the absence of integrity/availability impact make this a patch-in-normal-cycle priority rather than an emergency, absent any exploitation evidence. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on an internet- or intranet-reachable Oracle E-Business Suite instance sends crafted HTTP requests to the Internal Operations component of Oracle HRMS (US). Exploitation is low-complexity and requires no user interaction, allowing the attacker to read critical HRMS data they should not be able to access. No public proof-of-concept is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthorized access to critical Oracle HRMS (US) data is possible for low-privileged authenticated attackers who can reach the Internal Operations component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. Successful exploitation yields high confidentiality impact only, with no integrity or availability effect, and requires a valid EBS account but no user interaction and low attack complexity. At time of analysis, no public exploit identified, and no KEV or EPSS data was provided.
RemediationAI
Apply the Oracle E-Business Suite HRMS fix associated with Oracle's October 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; patch availability is indicated by the vendor advisory, but the input does not specify an exact fixed version, so confirm the applicable EBS/HRMS patch level with Oracle support. Until patched, reduce exposure by restricting network access to HRMS Internal Operations HTTP endpoints to trusted users and networks (side effect: limits legitimate remote HRMS access), removing or disabling unnecessary low-privilege EBS accounts (side effect: reduced business access for those users), and monitoring HRMS HTTP requests for anomalous data access by low-privileged users. Because exploitation requires a valid low-privilege account, enforcing least privilege and strong authentication on EBS accounts is a targeted compensating control, but it does not eliminate the underlying data-exposure flaw. No vendor-released patch version is identified in the provided data; absence of that detail is not confirmation that no patch exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite's HRMS (US) module includes an Internal Operations component exposed through the application's HTTP interface. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network reachability, low attack complexity, low privileges, no user interaction, unchanged scope, and confidentiality-only impact. No CWE identifier or CPE mapping was provided, so the underlying defect class cannot be confirmed from the available data; the practical issue is that an authenticated low-privilege user can obtain HRMS data beyond intended scope. Although the input carries an 'Authentication Bypass' tag, the authoritative assessment and CVSS vector require PR:L, so this should not be interpreted as unauthenticated access. Exploitation requires the HRMS HTTP interface to be reachable and a valid low-privilege EBS account; it does not imply unauthenticated access, code execution, data modification, or denial of service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP access and low complexity, but a valid low-privilege account is required (PR:L); impact is confidentiality-only (C:H, I:N, A:N) with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB