Oracle HRMS (UK) EUVD-2026-106307

Exploitation requires the attacker to possess a valid low-privilege authenticated account on Oracle HRMS (UK) within Oracle E-Business Suite 12.2.3-12.2.15 (PR:L), and additionally requires human interaction from a separate victim user who must view or act on the attacker-supplied content (UI:R) for the payload to trigger. The scope change means successful execution can affect additional EBS products beyond HRMS (UK). Limiting factors that reduce real-world risk: no anonymous/unauthenticated path exists, the mandatory second-party interaction prevents fully automated mass exploitation, and impact is bounded to partial data reads and some write access with no availability effect.

This is a moderate-severity, context-dependent issue rather than an urgent priority. The CVSS 3.1 base score of 5.4 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a consistent story: network-reachable and low-complexity, but gated behind two meaningful barriers - the attacker must already hold low-privilege authenticated access (PR:L) and must induce human interaction from a different victim (UI:R). The scope change (S:C) combined with low confidentiality and integrity impact and no availability impact (C:L/I:L/A:N) is the classic signature of a cross-site-scripting / injection-style flaw where attacker-controlled content executes in a victim's authenticated session and reaches beyond the immediately vulnerable module. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so there is no public exploit identified at time of analysis. One data-quality concern: the input carries an 'Authentication Bypass' tag, which directly contradicts the CVSS vector - a genuine auth bypass would be PR:N, whereas this vulnerability explicitly requires PR:L authenticated privileges and victim interaction. Treat that tag as suspect and verify against Oracle CPU October 2026 advisory. Net: real but not high-urgency; prioritize behind unauthenticated/no-interaction EBS flaws in the same patch set.

A low-privileged but authenticated Oracle E-Business Suite user crafts a malicious payload within the HRMS (UK) Internal Operations component and plants it where another user - such as an HR administrator - will encounter it. When that victim views the attacker-influenced content in their authenticated session, the payload executes in their context, allowing limited unauthorized reads and some update/insert/delete actions whose effect can extend to other EBS products via the scope change. No public exploit was identified at time of analysis.