Oracle HRMS EUVD-2026-106304

Requires a valid low-privileged Oracle HRMS (US) account (PR:L) with network HTTP access to the Internal Operations component; affected deployments are Oracle E-Business Suite HRMS versions 12.2.3 through 12.2.15. No user interaction and low attack complexity, so any authenticated foothold suffices. The key limiting factor is the authentication prerequisite - the attacker must already hold credentials, so unauthenticated internet-facing exploitation is not possible; impact is read-only (confidentiality), with no write or denial-of-service capability.

This is a moderate-risk confidentiality issue that should be patched on a normal Oracle Critical Patch Update cadence rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 MEDIUM) describes a network-reachable, low-complexity attack that nonetheless requires low-level privileges (PR:L) - i.e. the attacker must already hold a valid, if unprivileged, Oracle HRMS account. Impact is confined to confidentiality (C:H, I:N, A:N): full read access to HRMS data, but no integrity or availability damage and no scope change (S:U). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no current signal of active or imminent exploitation - no public exploit identified at time of analysis. The signals are internally consistent except for the metadata: the input 'Authentication Bypass' tag conflicts with the CVSS PR:L requirement, which explicitly demands existing authentication - verify this tag, as the flaw is an authenticated data-access issue, not an auth bypass. Net assessment: a real but non-urgent priority, elevated by the sensitivity of HR/PII data in HRMS and the broad affected range (12.2.3-12.2.15), tempered by the authentication prerequisite and absence of exploitation evidence.

An attacker possessing a low-privileged Oracle HRMS (US) user account sends crafted HTTP requests to the Internal Operations component, abusing missing or broken access controls to read HR data they are not authorized to see - potentially employee PII, compensation, or other critical HRMS records. No user interaction is required and attack complexity is low, so a single valid foothold account is sufficient. No public exploit code is identified at time of analysis.