Oracle HCM Configuration Workbench EUVD-2026-47545

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L per CVSS vector) and HTTP network access to the Oracle EBS application server hosting the HCM Configuration Workbench Install component. The component must be deployed and reachable - standard in most EBS HCM implementations. No user interaction is required (UI:N). Scope is unchanged (S:U), meaning impact is confined to the HCM Configuration Workbench component and its accessible data. Exploitation is strictly limited to authenticated users: unauthenticated external attackers cannot exploit this vulnerability directly. Organizations that restrict EBS application access to internal networks or VPN further reduce exposure to external threat actors, but do not mitigate insider or compromised-credential scenarios.

The CVSS 3.1 base score of 6.3 (Medium) accurately reflects the attack profile: network-reachable (AV:N), low complexity (AC:L), low-privilege credential requirement (PR:L), no user interaction (UI:N), and unchanged scope (S:U), with all three CIA impacts rated Low. Oracle's own characterization of the flaw as 'easily exploitable' aligns with the AC:L/PR:L metrics - the principal barrier to exploitation is possession of a valid low-privileged EBS account, not technical sophistication. No EPSS score is available in the provided data, preventing probabilistic exploitation likelihood assessment. No KEV listing exists and no POC has been identified, indicating no confirmed threat actor activity at time of analysis. The combined C:L/I:L/A:L impact profile limits blast radius: this is not a full-compromise or data-exfiltration-at-scale vulnerability, but rather a partial data manipulation and disruption risk. Oracle EBS environments are typically enterprise-internal, which reduces exposure to external attackers but elevates insider threat relevance. Real-world priority should be moderate: patch during the next planned maintenance window rather than emergency response, unless insider risk posture is elevated.

An insider or post-breach attacker with a low-privileged Oracle EBS account sends crafted HTTP requests to the Install component of the HCM Configuration Workbench. Leveraging the authorization flaw, the attacker reads restricted HCM configuration or employee records, manipulates (inserts, updates, or deletes) data within the component's accessible scope, and degrades the component's availability - potentially disrupting HCM configuration workflows. No POC code is publicly known at time of analysis.