Oracle HR Intelligence EUVD-2026-37240

Exploitation requires an authenticated session on Oracle E-Business Suite with a high-privilege role that can reach the HR Intelligence 'Internal Operations' component over HTTP, and the target EBS deployment must be running HR Intelligence at version 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the PR:H precondition limits exploitation to attackers who already possess privileged EBS credentials or have compromised an account with HR Intelligence administrative rights; the EBS mid-tier HTTP endpoint must also be network-reachable to the attacker, which in well-segmented deployments restricts the attack to internal networks or VPN-connected administrators.

Signals point to a moderately high real-world risk but not a fire-drill: CVSS 3.1 is 7.2 with AV:N/AC:L/PR:H/UI:N and full C/I/A, so once an attacker holds a high-privilege EBS account the takeover path is straightforward and reliable. There is no EPSS score, no SSVC decision, no CISA KEV listing, and no public POC in the provided data, so exploitation appears opportunistic rather than mass-scanned. PR:H meaningfully constrains the population of viable attackers to insiders or post-compromise actors who have already obtained privileged EBS credentials, which is exactly the threat model where Oracle EBS environments are most often abused. Conflicting signal to note: the description says 'high privileged attacker' yet tags include 'Information Disclosure' while CVSS reports C:H/I:H/A:H - the tag understates the impact and should not be relied on; the CVSS impact metrics are authoritative.

An attacker who has obtained or been issued a high-privilege Oracle EBS account - for example a compromised HR administrator, an over-privileged integration service account, or a malicious insider - sends crafted HTTP requests to the HR Intelligence Internal Operations endpoints from anywhere the EBS mid-tier is reachable. Because attack complexity is low and no user interaction is required, the attacker reliably takes over the HR Intelligence module, reading or altering sensitive HR data and disrupting reporting. No public exploit is identified at time of analysis, so this would most plausibly arrive as a post-credential-compromise privilege abuse rather than an opportunistic internet-wide attack.