Description
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: System Takeover
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Internal Operations component of Oracle HCM Common Architecture lets an attacker with low privileges and network access via HTTP compromise the application. Successful exploitation permits complete takeover, affecting confidentiality, integrity, and availability of the HCM Common Architecture system.

Affected Systems

Oracle HCM Common Architecture, part of Oracle E‑Business Suite, is affected. Vulnerable releases are 12.2.3 through 12.2.15, inclusive. No other Oracle products or versions are listed as impacted.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates a high‑severity flaw. EPSS information is not available and the vulnerability is not listed in CISA KEV, suggesting no known active exploitation in the wild. The attack vector is network‑based via HTTP, requiring only low‑privileged user access and no special user interaction. If exploited, the attacker would gain full control over Oracle HCM Common Architecture.

Generated by OpenCVE AI on October 21, 2026 at 03:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch from the October 2026 CPU or subsequent releases that addresses CVE‑2026‑101826.
  • Restrict HTTP access to the HCM Common Architecture to trusted internal networks or VPNs, preventing public or untrusted external connections.
  • Run HCM services with the least privilege necessary, audit user accounts, and monitor application logs for anomalous activity that may indicate compromise.

Generated by OpenCVE AI on October 21, 2026 at 03:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Attack Enables Total Takeover of Oracle HCM Common Architecture
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hcm Common Architecture
CPEs cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hcm Common Architecture
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hcm Common Architecture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:13:54.345Z

Reserved: 2026-09-28T15:40:09.509Z

Link: CVE-2026-101826

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:38.607

Modified: 2026-10-22T16:17:19.643

Link: CVE-2026-101826

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:45:14Z

Weaknesses