Human Capital Management Configuration Workbench
Monthly
Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.
Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.
Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.
Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.
Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.
Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.
Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.
Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.
Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.