Hcm Common Architecture
Monthly
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.