Oracle HRMS EUVD-2026-47501

Exploitation requires network access to the Oracle HRMS (UK) Internal Operations component over HTTPS AND a valid low-privileged EBS account (CVSS PR:L), on a supported EBS release in the 12.2.3-12.2.15 range. It is explicitly rated high attack complexity (AC:H) by Oracle ('difficult to exploit'), meaning the attacker must satisfy additional non-default preconditions beyond simply reaching the endpoint; no user interaction is required (UI:N). Limiting factors: the authentication requirement (a low-privilege login is a prerequisite per the CVSS vector), the high-complexity conditions, and the need for the affected HRMS (UK) module to actually be deployed and reachable. Note the vendor tag 'Authentication Bypass' conflicts with PR:L in the vector; if a true pre-auth bypass exists the privilege prerequisite could be lower, so confirm the exact requirement against the Oracle CPU July 2026 advisory.

The signals are mixed. The CVSS 3.1 base score of 8.2 is driven up by the scope change (S:C) and dual High confidentiality/integrity impact, but is tempered by AC:H (Oracle explicitly calls it 'difficult to exploit') and PR:L (a valid low-privileged account is required), which meaningfully raise the bar versus a raw 8.2 pre-auth network flaw. No EPSS score, no CISA KEV entry, and no known public POC are present in the input, indicating this is not currently a mass-exploitation candidate. There is a notable conflict to flag: the intelligence tag says 'Authentication Bypass' while the CVSS vector requires PR:L (authenticated) - these disagree, and the true privilege prerequisite should be verified against the Oracle CPU July 2026 advisory before treating it as unauthenticated. Overall this is a genuine High-severity issue worth prioritized patching for EBS operators, but not an emergency drop-everything item absent evidence of exploitation.

An attacker who holds or phishes a valid low-privilege EBS/HRMS user account sends specially crafted HTTPS requests to the HRMS (UK) Internal Operations component, chaining the non-trivial preconditions needed to bypass authorization checks and read or tamper with critical HR data, then pivots via the scope change to affect other EBS resources. The high attack complexity (AC:H) means the attacker must satisfy specific conditions, so success is not guaranteed on a single attempt. No public proof-of-concept was identified in the available data.