Oracle HRMS EUVD-2026-47558

Exploitation requires a valid, low-privileged authenticated account within the Oracle E-Business Suite instance, confirming this is not an unauthenticated attack - the CVSS PR:L metric establishes this baseline. The attacker must have network-level HTTP access to the Oracle EBS application server. The vulnerability is specific to the Internal Operations component of Oracle HRMS (US); other EBS modules are not indicated as affected. Limiting factors include: the requirement for at least a low-privilege EBS account (eliminating fully external, unauthenticated attackers); the vulnerability is scoped exclusively to Oracle HRMS (US) versions 12.2.3-12.2.15; and impact is restricted to confidentiality with no ability to modify or disrupt data or availability. The 'Authentication Bypass' tag may indicate that a low-privilege account can bypass object-level authorization controls to access data normally restricted to higher-privilege roles, but full pre-authentication exploitation is not confirmed by the available CVSS data.

The vendor CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N presents a clear and consistent risk picture: the flaw is exploitable over the network, requires no special conditions, needs only a low-privilege authenticated account, and yields complete read access to HRMS data - which in HR contexts typically includes employee PII, compensation, tax, and benefits records. This elevates practical business risk beyond what the numeric score alone suggests. No EPSS data was provided, so exploitation probability cannot be quantified independently. No KEV listing and no confirmed POC reduce immediate urgency, but the low attack complexity and absence of user interaction mean exploitation is straightforward once access conditions are met. The 'Authentication Bypass' tag from EUVD introduces a minor ambiguity: if the tag reflects the attacker being able to bypass object-level authorization (rather than bypassing login entirely), the PR:L metric is consistent and the tag is not misleading. However, if the tag implies pre-auth access, the vendor CVSS vector would understate severity - this discrepancy should be verified against the full Oracle CPU advisory. No integrity or availability impact is indicated, narrowing attacker objectives to data exfiltration.

An attacker with a valid low-privilege Oracle EBS account - such as a contractor, auditor, or limited HR self-service user - sends a crafted HTTP request targeting the Internal Operations component of Oracle HRMS (US). By exploiting the authorization weakness, the attacker reads HR records beyond their intended access scope, potentially exfiltrating employee compensation, tax identifiers, or benefits data for all employees visible to the HRMS module. No public proof-of-concept code has been identified at time of analysis.