Oracle HRMS Japanese EUVD-2026-47442

The victim must be an authenticated Oracle HRMS (Japanese) user - typically an HR administrator or payroll operator - with an active HTTPS session to Oracle E-Business Suite at the time of the attack. The attacker must successfully induce this authenticated user to interact with a malicious link or page (UI:R), consistent with phishing, spear-phishing, or watering-hole delivery. The targeted EBS instance must be running Oracle Payroll Japanese component on versions 12.2.3 through 12.2.15 and must be reachable from the attacker's network over HTTPS. No special non-default configuration is described as required. Exploitation is limited by: (1) the mandatory human-interaction step, which prevents fully automated scanning/exploitation; (2) the Japan-specific payroll component, which narrows the population of deployments; and (3) network reachability - if the EBS instance is internal-only, an external attacker must first gain network access.

The CVSS 3.1 score of 5.4 (Medium) reflects a genuinely moderate risk: the attack is low-complexity and requires no privileges (PR:N), but is gated on human interaction (UI:R) - meaning it cannot be fully automated at scale without a phishing or social-engineering step. The 'Authentication Bypass' tag is somewhat misleading given PR:N in the vector; the more accurate framing is that the attacker bypasses the need for their own credentials by hijacking an active victim session, not that authentication itself is broken at the server. Impact is bounded to Confidentiality:Low and Integrity:Low with no Availability impact, limiting the blast radius to data manipulation rather than system compromise. EPSS data was not provided in the input and cannot be estimated without it. No KEV listing and no POC code have been identified, indicating this is not under active widespread exploitation. Real-world priority is moderate for Japan-region Oracle EBS deployments: the data at risk (payroll records) is sensitive, but exploitation requires targeting a logged-in HR or payroll administrator, narrowing the realistic attacker pool to those capable of spear-phishing specific users.

An attacker crafts a malicious webpage or email link embedding a forged HTTPS request targeting the Oracle Payroll Japanese endpoint - for example, a hidden form submission or image tag that triggers a data-modification action. When a logged-in HR administrator visits or clicks the link, their active EBS session is used to execute the request, allowing the attacker to read or tamper with payroll records without ever possessing valid credentials. No public proof-of-concept code has been identified, making this scenario speculative but consistent with the CVSS vector and Authentication Bypass tag.