Oracle HRMS (UK) EUVD-2026-47500

Exploitation requires a valid low-privileged account with network access to the Oracle E-Business Suite application tier via HTTP. The CVSS vector (PR:L) confirms that some level of authentication is mandatory - unauthenticated exploitation is not possible. The affected deployment must be running Oracle HRMS (UK) versions 12.2.3 through 12.2.15 with the Internal Operations component accessible. No non-default configuration flag or special feature enablement is described as required. Limiting factors include the mandatory low-privileged authentication barrier (attackers must possess or steal valid EBS credentials), the scope-unchanged impact (exploitation cannot pivot to other EBS modules beyond what HRMS (UK) itself exposes), and the UK-regional nature of the module (only EBS deployments with UK HRMS licensed and deployed are affected). The partial DoS and data access impacts are bounded to Oracle HRMS (UK) accessible data only.

The CVSS 3.1 base score of 6.3 (Medium) accurately reflects the scope-unchanged, multi-low-impact nature of this flaw. The attack vector is network (AV:N) with low access complexity (AC:L) and low privilege (PR:L), meaning any authenticated EBS user could potentially trigger the issue. In an enterprise Oracle EBS deployment, low-privileged accounts are common among HR staff, payroll processors, and contractors, expanding the realistic attacker pool beyond external threats to include insiders. EPSS data was not provided in available intelligence sources, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, suggesting no confirmed active exploitation at time of analysis. The 'easily exploitable' designation from Oracle's own advisory language is a significant qualitative signal - Oracle applies this label specifically to vulnerabilities with AC:L/UI:N characteristics, reinforcing that technical exploitation is straightforward once access is obtained. The partial DoS component (A:L) adds operational risk in payroll-processing environments. Overall, this is a genuine medium-priority issue for organizations running Oracle EBS with UK HRMS: not critical in isolation, but meaningful given the sensitive nature of HR and payroll data and the wide affected version range.

An authenticated Oracle EBS user - such as a standard HR clerk, contractor, or a compromised service account - sends a crafted HTTP request to the Internal Operations component of Oracle HRMS (UK). Without additional complexity or user interaction, the request triggers improper authorization logic, allowing the attacker to read restricted HR records, manipulate payroll or employee data entries, and cause intermittent service disruption for other users of the HRMS module. Because Oracle characterizes the vulnerability as easily exploitable and no special configuration is required beyond possessing a valid low-privileged account, the scenario is accessible to malicious insiders or attackers who have previously compromised EBS credentials.