EUVD-2026-24384
GHSA-jfmq-5jhp-qf3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS HTTP endpoint
-
DeliverySend crafted request to Knowledge Integration
-
ExploitBypass access control (CWE-200)
-
ExecutionRead critical HCM data
-
ImpactExfiltrate sensitive records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against affected Oracle E-Business Suite deployments running Oracle HCM Common Architecture 12.2.3-12.2.15 with the Knowledge Integration component reachable (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is network reachability: the HCM Common Architecture / EBS HTTP endpoint must be accessible to the attacker, so instances confined to internal networks or behind VPN/IP allowlists are far harder to reach. Impact is confined to confidentiality (data read), not integrity or availability. |
| Impact | The signals are mixed. CVSS 3.1 is 7.5 with the most severe exposure metrics for exploitability (AV:N/AC:L/PR:N/UI:N) - remote, low-complexity, unauthenticated, no user interaction - which normally implies broad, easy attack surface, and SSVC marks it Automatable:yes with partial technical impact, reinforcing that mass, scripted data harvesting is plausible. Counterbalancing this, EPSS is only 0.03% (9th percentile), it is NOT in CISA KEV (SSVC exploitation:none), and no public PoC is identified, so real-world exploitation is currently unobserved. Note a data conflict: the source tags include 'Authentication Bypass,' yet the CVSS vector and description describe confidentiality-only information disclosure (C:H, I:N, A:N) rather than a true authentication bypass - treat the tag as loosely applied and prioritize the CVSS/CWE-200 framing. Net: a genuine priority for internet-exposed EBS instances because it is unauthenticated and automatable, but not yet under active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle E-Business Suite HTTP interface sends crafted requests to the HCM Common Architecture Knowledge Integration endpoint and retrieves sensitive HCM records without any credentials or user interaction. Because the attack is network-based and low-complexity, it can be scripted (SSVC Automatable:yes) to sweep many internet-exposed EBS instances, though no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.
RemediationAI
Apply the fixes from the Oracle April 2026 Critical Patch Update; patch is available per vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html, though Oracle does not publish a single discrete fixed build number for this component (fixes are delivered as CPU patch sets against the 12.2.x line). Because exploitation is unauthenticated and over HTTP, if you cannot patch immediately, restrict network reachability of the affected EBS/HCM endpoints - place them behind a VPN or IP allowlist, block untrusted access to the Knowledge Integration interface at the reverse proxy/WAF, and monitor HTTP logs for anomalous data-retrieval requests; the trade-off is that URL/IP filtering may disrupt legitimate integrations that call these endpoints and a WAF rule risks false positives, so validate against known integration traffic before enforcing. Given the internet-facing, automatable nature, prioritize removing direct external exposure of Oracle E-Business Suite as the key compensating control until the CPU is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Knowledge Integration component of Oracle HCM Common Architecture, a shared services layer within the Oracle E-Business Suite ERP platform (CPE cpe:2.3:a:oracle_corporation:oracle_hcm_common_architecture). It is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning an HTTP-accessible endpoint returns or exposes data it should protect, without enforcing proper access control. Because the CVSS scope is Unchanged (S:U) and only confidentiality is affected (C:H, I:N, A:N), the weakness reads more like a broken/absent authorization check on a data-serving interface than a memory-corruption or code-execution bug; data can be extracted but not modified and service availability is unaffected.
Know when Oracle Hcm Common Architecture gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description confirms unauthenticated network HTTP access (AV:N/PR:N/UI:N/AC:L) with confidentiality-only data exposure, so C:H and I:N/A:N, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle HCM Common Architecture in E-Business Suite versions 12.2.3-12.2.15 contains an unauthenticated remote information disclosure vulnerability exposing critical employee and payroll data. No public exploit identified at time of analysis, though the attack is automatable and can be performed by any remote actor without authentication or credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network-level access controls restricting HCM system access via IP whitelisting or VPN-only enforcement; deploy WAF rules to block malicious requests to Knowledge Integration endpoints; disable the Knowledge Integration component if not required for business operations; implement continuous monitoring of HCM access logs for suspicious data access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB