Oracle HRMS Ireland EUVD-2026-47208

Exploitation requires an attacker to already possess high-privilege credentials within Oracle E-Business Suite (PR:H), limiting the threat actor set to insider threats, compromised privileged accounts, or attackers who have completed a separate initial access and privilege escalation chain. High attack complexity (AC:H) imposes additional undefined environmental prerequisites beyond merely having credentials - the specific triggering condition is not disclosed in the description or CWE, but AC:H typically implies a race condition, specific configuration state, or timing requirement. Access must occur over HTTP via network (AV:N), so the attacker's high-privilege account must have network reachability to the EBS application tier. No user interaction is required (UI:N). Exploitation is bounded to read-only access on a partial data subset - no write, modify, or service disruption is possible. The 'Authentication Bypass' tag has not been verified against the Oracle advisory and conflicts with the PR:H requirement; if the tag is accurate for a specific sub-scenario, conditions may differ from what the CVSS vector implies.

Real-world risk for this vulnerability is very low across all available signals. The CVSS 3.1 score of 2.2 is in the lowest tier, driven by three compounding constraints: AC:H (high attack complexity requiring specific conditions to be met), PR:H (attacker must already hold high privileges), and C:L (only a partial data subset is exposed). No EPSS score is provided in the intelligence data. KEV status is negative and no POC has been identified, indicating no known active exploitation. The practical threat model is extremely narrow: an attacker who has already achieved high-privilege access to Oracle EBS and can engineer specific environmental conditions to meet AC:H would have numerous higher-value attack paths available. The 'Authentication Bypass' tag in source intelligence conflicts directly with PR:H in the CVSS vector - if bypass of authentication were genuine, the vector would be PR:N and the score substantially higher. This inconsistency should be resolved by reviewing the Oracle CPU July 2026 advisory directly.

A high-privileged Oracle EBS user - such as an HR administrator or system operator with elevated access - sends a specially crafted HTTP request to the Oracle HRMS (Ireland) Internal Operations component under specific environmental or configuration conditions that satisfy the AC:H requirement. The request circumvents an internal access control check, returning a limited subset of HRMS data the attacker's role should not be authorized to read. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely.