HCM Configuration Workbench EUVD-2026-47453

Exploitation requires network HTTP access to an Oracle E-Business Suite instance running the HCM Configuration Workbench module with the Spreadsheet Loading component present, on releases 12.2.3 through 12.2.15. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no privileges, and no user interaction are required - remote unauthenticated exploitation is possible against affected configurations reachable over HTTP. The primary limiting factor is reachability of the EBS web tier: instances behind a URL firewall, VPN, or network segmentation that block external access to the Spreadsheet Loading endpoint are not exposed, and only EBS 12.2.3-12.2.15 with this HCM module deployed are in scope.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) is internally consistent: network attack vector, low complexity, no privileges, and no user interaction describe a genuinely remote, unauthenticated, easily repeatable attack, while the three Low impact metrics cap real-world severity because access is limited to a subset of module data and only a partial DoS is possible. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are unknown; this is a high-CVSS issue whose true urgency depends on internet-exposure of the EBS instance. There is no conflict between the vector and the description - both point to unauthenticated HTTP access - but the absence of any exploit-maturity intelligence means priority should be driven by exposure (internet-facing EBS = high priority; internal-only = moderate) rather than by evidence of active attacks.

An attacker who can reach an internet- or intranet-exposed Oracle EBS instance sends crafted HTTP requests to the HCM Configuration Workbench Spreadsheet Loading endpoint without authenticating, and uses it to insert, alter, or delete a subset of HCM configuration data or read limited data. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication mean a working request could be reproduced reliably once the endpoint behavior is understood.