Irecruitment
Monthly
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Vulnerability in the Oracle iRecruitment component of Oracle E-Business Suite (subcomponent: Password Reset). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows local users to affect confidentiality, integrity, and. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Vulnerability in the Oracle iRecruitment component of Oracle E-Business Suite (subcomponent: Password Reset). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows local users to affect confidentiality, integrity, and. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity.