Oracle iRecruitment EUVD-2026-47246

Exploitation requires network access to the Oracle iRecruitment HTTP interface plus a valid low-privilege account (CVSS PR:L) - it is authenticated, not fully anonymous, despite the 'Authentication Bypass' tag; the vector's PR:L means the attacker must already be able to log in at a low level. Only Oracle E-Business Suite deployments running iRecruitment versions 12.2.3 through 12.2.15 with the Internal Operations component reachable are affected. Limiting factors: an account is needed (though in EBS this bar is low where self-registration or broad internal access exists), the impact is confined to iRecruitment-accessible data (scope unchanged), and there is no availability impact. No user interaction and low attack complexity mean that, given a credential and network path, no special non-default configuration is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a genuinely high-severity, low-friction issue: network-reachable over HTTP, low attack complexity, no user interaction, and only a low-privilege account needed - a low bar in EBS environments where many internal users or self-registered applicants hold accounts. Confidentiality and integrity are fully impacted (availability is not). No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; likewise no POC was reported, so this is not confirmed weaponized. The main tension in the data is the 'Authentication Bypass' tag versus PR:L in the vector - the vector clearly requires an existing low-privilege credential, so treat this as authenticated authorization abuse, not fully unauthenticated bypass; verify the exact privilege prerequisite against Oracle's advisory. Given EBS's exposure in enterprise environments and the low exploitation bar, this warrants prompt patching even absent public exploit code.

An attacker who holds or self-registers a low-privilege iRecruitment account (for example, an external applicant or a rank-and-file internal user) sends crafted HTTP requests to Internal Operations functionality and, through the authorization weakness, reaches records and actions outside their entitlement. They exfiltrate sensitive recruiting/candidate data and tamper with or delete iRecruitment records. No public exploit code has been reported, and low attack complexity with no user interaction means the technique, once known, requires little effort to repeat.