Oracle E-Business Suite EUVD-2026-37266

Exploitation requires a network-reachable Oracle E-Business Suite deployment running Oracle Human Resources versions 12.2.3-12.2.15 with the Person component exposed over HTTP, plus user interaction (UI:R) from a person other than the attacker - typically an authenticated HR user who must be induced to load attacker-supplied content. The attacker themselves needs no credentials (PR:N), but high attack complexity (AC:H) indicates additional conditions outside the attacker's control must align, such as a specific session state or configuration of the Person flow. Limiting factors: instances reachable only via VPN, strict same-site cookies, no concurrent authenticated HR session, or upgraded versions (post-12.2.15 or June 2026 CPU applied) prevent the chain.

CVSS 3.1 is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - network-reachable and unauthenticated, but tempered by high attack complexity and the need for a second user (not the attacker) to interact. EPSS, KEV status, and SSVC inputs were not supplied, and no POC is referenced; the only source is Oracle's quarterly Critical Patch Update advisory. Real-world risk is meaningful for internet-exposed or partner-accessible EBS HR portals because impact is full module takeover, but the AC:H plus UI:R combination makes opportunistic mass exploitation unlikely - this is a patch-on-CPU-cycle item rather than an emergency unless an exploit surfaces.

A remote attacker crafts a malicious HTTP request or link targeting the Person component and lures an authenticated HR user - for example a payroll administrator - into visiting it via phishing or a watering-hole page. When that second user's browser issues the request against the EBS instance, the attacker leverages their session to alter or read employee records and ultimately take over the Oracle Human Resources module. No public exploit identified at time of analysis.