Irecruitment
Monthly
Let me produce the JSON. Key details: Oracle iRecruitment in Oracle E-Business Suite, versions 12.2.3-12.2.15. CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. CWE N/A. Tags: Authentication Bypass, Oracle. Reference: Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC info. Note: CVSS says PR:L — low privileged authenticated. But the tag says "Authentication Bypass". Slight conflict — should note in confidence_notes/risk_assessment. Actually PR:L means attacker needs low-privileged credentials (authenticated user). The tag "Authentication Bypass" is possibly mislabeled; hmm, should I flag it? The tag "Authentication Bypass" conflicts with PR:L. But data_quality_flags should only be used for concrete verifiable issues — mislabeled tags. Hmm, "Authentication Bypass" vs PR:L... The CVSS vector is authoritative from NVD. It's arguably a conflicting tag. But the guidance says don't flag severity/CVSS disagreements... it says "Do NOT flag severity/CVSS/version disagreements here". A tag mislabel is different. Still, I'd be moderately confident. I think I'll leave the array empty, or maybe flag it? Let me think: type "mislabeled_tag" for "Authentication Bypass" — target is exact wrong value as it appears in Tags. Reason: CVSS vector indicates PR:L requiring credentials, not an auth bypass. Confidence medium. Hmm, but the tag could reflect something else (e.g., unauthorized access to data via a bypass within the app). Risky. I'll emit empty array to be safe... Actually the instruction says only emit when high confidence and clearly verifiable. I'm not high confidence. Empty array. Also "Oracle" tag is correct vendor. Missing tags? Could suggest "oracle-ebs" or "e-business-suite"? Not a standard platform tag necessarily. I'll leave empty. Prevalence: Oracle E-Business Suite is enterprise ERP widely deployed in large enterprises. "high" or "medium". EBS is widely deployed in large enterprises/government. I'd say "high" — but it's not everywhere. I'd say "medium"
Oracle iRecruitment, a module of Oracle E-Business Suite, contains an easily exploitable flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15. An attacker holding a low-privileged account can exploit it over HTTP without user interaction to read critical recruitment data and modify some of it, with the impact able to extend into other EBS modules because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV listing was identified at time of analysis, so prioritization should rest on the CVSS 8.5 base score and the breadth of the affected version range rather than observed exploitation.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Vulnerability in the Oracle iRecruitment component of Oracle E-Business Suite (subcomponent: Password Reset). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows local users to affect confidentiality, integrity, and. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity.
Let me produce the JSON. Key details: Oracle iRecruitment in Oracle E-Business Suite, versions 12.2.3-12.2.15. CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. CWE N/A. Tags: Authentication Bypass, Oracle. Reference: Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC info. Note: CVSS says PR:L — low privileged authenticated. But the tag says "Authentication Bypass". Slight conflict — should note in confidence_notes/risk_assessment. Actually PR:L means attacker needs low-privileged credentials (authenticated user). The tag "Authentication Bypass" is possibly mislabeled; hmm, should I flag it? The tag "Authentication Bypass" conflicts with PR:L. But data_quality_flags should only be used for concrete verifiable issues — mislabeled tags. Hmm, "Authentication Bypass" vs PR:L... The CVSS vector is authoritative from NVD. It's arguably a conflicting tag. But the guidance says don't flag severity/CVSS disagreements... it says "Do NOT flag severity/CVSS/version disagreements here". A tag mislabel is different. Still, I'd be moderately confident. I think I'll leave the array empty, or maybe flag it? Let me think: type "mislabeled_tag" for "Authentication Bypass" — target is exact wrong value as it appears in Tags. Reason: CVSS vector indicates PR:L requiring credentials, not an auth bypass. Confidence medium. Hmm, but the tag could reflect something else (e.g., unauthorized access to data via a bypass within the app). Risky. I'll emit empty array to be safe... Actually the instruction says only emit when high confidence and clearly verifiable. I'm not high confidence. Empty array. Also "Oracle" tag is correct vendor. Missing tags? Could suggest "oracle-ebs" or "e-business-suite"? Not a standard platform tag necessarily. I'll leave empty. Prevalence: Oracle E-Business Suite is enterprise ERP widely deployed in large enterprises. "high" or "medium". EBS is widely deployed in large enterprises/government. I'd say "high" — but it's not everywhere. I'd say "medium"
Oracle iRecruitment, a module of Oracle E-Business Suite, contains an easily exploitable flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15. An attacker holding a low-privileged account can exploit it over HTTP without user interaction to read critical recruitment data and modify some of it, with the impact able to extend into other EBS modules because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV listing was identified at time of analysis, so prioritization should rest on the CVSS 8.5 base score and the breadth of the affected version range rather than observed exploitation.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Oracle iRecruitment, the recruitment module of Oracle E-Business Suite, exposes an access-control weakness in its Internal Operations component across versions 12.2.3 through 12.2.15 that lets an attacker on the same physical network segment read, create, modify, or delete recruitment data without authenticating. The flaw is rated difficult to exploit (CVSS 6.8, AV:A/AC:H/PR:N/UI:N) because it demands layer-2 adjacency to the application host and a race-prone or otherwise unreliable attack path, but it delivers high confidentiality and integrity impact with no availability loss. No public exploit code or CISA KEV entry was present in the supplied intelligence, so exploitation is not confirmed in the wild.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Vulnerability in the Oracle iRecruitment component of Oracle E-Business Suite (subcomponent: Password Reset). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows local users to affect confidentiality, integrity, and. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity.