EUVD-2026-47546
GHSA-w2mf-h36g-4f8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
ExploitReach French HR module over HTTP
-
ExecutionSend crafted request bypassing access controls
-
ImpactRead or modify critical HRMS (France) data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a low-privileged authenticated Oracle E-Business Suite account (CVSS PR:L) with HTTP network reachability to the Oracle HRMS (France) / French HR component on a system running EBS versions 12.2.3-12.2.15. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the deployment must actually have the French HR (HRMS France) localization module installed and network-accessible, and the attacker must already possess valid credentials for some EBS account - it is not fully unauthenticated despite the 'Authentication Bypass' tag, which should be verified against Oracle's advisory. |
| Impact | The signals are moderately strong but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality and integrity impact but no availability effect - consistent with an authenticated data-access/manipulation flaw rather than remote code execution. Oracle explicitly calls it 'easily exploitable,' aligning with AC:L. However, no EPSS score, no POC, and no KEV listing are present in the provided data, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the PR:L requirement in the CVSS vector - verify with Oracle whether an authenticated foothold is genuinely needed. Net assessment: a real High-severity priority for organizations running the French HR module because the barrier is only a low-privileged account, but the absence of exploit evidence suggests it is not yet under mass exploitation. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Oracle EBS account (for example a limited self-service HR login) sends crafted HTTP requests to the French HR component and reads or alters critical HRMS (France) records such as payroll or personnel data outside their authorization. Because attack complexity is low and no user interaction is required, the requests can be scripted; no public POC is currently available, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
RemediationAI
Apply the patch delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary vendor-recommended fix, and because Oracle CPU patches are cumulative, applying the latest CPU for EBS 12.2.x resolves this issue. An exact standalone fix version is not independently stated in the provided data, so treat the status as 'Patch available per vendor advisory' and confirm the specific patch/bundle number from the CPU matrix for your EBS release. As compensating controls until patched, restrict HTTP access to the French HR (HRMS France) module and its responsibilities to only required users, tighten EBS responsibility and function security so low-privileged accounts cannot reach French HR pages, and place the application tier behind a reverse proxy or WAF with access limited to trusted networks/VPN; the trade-off is potential disruption to legitimate French HR users and administrative overhead in re-scoping responsibilities. Review HRMS audit logs for anomalous read or modification activity on French HR data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's integrated ERP/HCM application suite; the affected element is the French HR (HRMS France) localization component handling payroll and human-resources data under French regulatory requirements. Because EBS exposes its modules over HTTP through the Oracle Application Server tier, a network-facing HTTP request path is the exposed surface. Oracle assigned no CWE (CWE: N/A), so the precise weakness class is undocumented; the intelligence tag labels it 'Authentication Bypass,' yet the CVSS vector requires low privileges (PR:L), meaning the attacker must hold some authenticated account rather than being fully anonymous. This tension between the tag and PR:L points to a horizontal/vertical authorization or access-control weakness in the component rather than a true pre-auth bypass.
Know when Human Resources Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP-reachable and low complexity per Oracle; requires an existing low-privileged EBS account so PR:L; data read and manipulation give C:H/I:H, with no availability impact so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite HRMS (France module) versions 12.2.3-12.2.15 contain a critical data compromise vulnerability (CVSS 8.1) allowing attackers with basic network access to read, create, delete, and modify sensitive employee records. Organizations running affected versions face immediate risk of HR data breach and regulatory exposure and should inventory affected systems and implement interim controls without delay.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict HTTP access to the affected HRMS (France) component; enforce role-based access controls limiting HRMS data access to authorized personnel only; enable database audit logging to detect unauthorized read or modification attempts; mask sensitive HR data in non-production systems; monitor for access pattern anomalies and data exfiltration indicators. These controls are interim only and do not eliminate the underlying vulnerability risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged rem
Exploit-DB