Oracle HRMS (US) EUVD-2026-47503

Exploitation requires a low-privileged attacker with an authenticated logon session on the operating system or application layer of the infrastructure host where Oracle HRMS (US) executes - this is a strictly local attack (AV:L, PR:L). The target system must be running Oracle E-Business Suite with HRMS (US) installed in versions 12.2.9 through 12.2.15. No user interaction is required once the logon session is established. Exploitation is fundamentally limited by the local access prerequisite: remote unauthenticated attackers cannot reach this vulnerability directly without first compromising the host through another means. Non-default deployment conditions such as network-exposed remote shell access would expand the realistic threat surface but are not implied by the CVE description itself.

The CVSS 3.1 base score of 6.6 (Medium) accurately reflects a locally-scoped, low-complexity attack constrained by the requirement for an authenticated low-privilege logon to the HRMS host. The AV:L vector is the dominant risk-limiting factor - this vulnerability is not remotely exploitable from external networks, substantially narrowing the realistic threat population to insiders, compromised service accounts, or attackers who have already established a foothold on the host. The A:H impact is the most operationally significant signal: a repeatable crash or hang of the HRMS process could disrupt payroll and HR operations. C:L and I:L indicate partial, non-comprehensive data exposure and modification capability - not a full data exfiltration or corruption scenario. No EPSS score was available in the source data, preventing probability-of-exploitation comparison. The vulnerability is absent from CISA KEV, and no POC has been identified, further supporting a scheduled rather than emergency remediation posture. SSVC would likely classify this as 'defer' or 'scheduled' for most enterprises unless insider threat modeling elevates the priority.

A low-privileged internal user or a compromised service account with OS-level or application-level logon access to the Oracle HRMS host submits a crafted request or operation targeting the Internal Operations component, triggering a repeatable process hang or crash and causing a denial of service for HR and payroll workflows. Concurrently, the attacker reads a limited subset of accessible HR records or makes unauthorized inserts or updates to HR data within their privilege scope. No public exploit code has been identified at time of analysis, making this scenario most realistic as an insider threat or post-compromise lateral movement action.