Description
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
Published: 2026-10-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and denial of service
Action: Patch
AI Analysis

Impact

This vulnerability exists in the Oracle HCM Common Architecture internal operations component. A low‑privileged attacker with network access via HTTP can create, delete, or modify critical data or gain full access to all accessible data, and can also cause a partial denial of service. The CVSS score of 7.1 reflects high confidentiality and integrity impact with moderate availability impact.

Affected Systems

The affected product is Oracle HCM Common Architecture, part of Oracle E‑Business Suite. Supported versions that are affected are 12.2.3 through 12.2.15 inclusive.

Risk and Exploitability

The CVSS base score is 7.1. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires network connectivity to the application over HTTP from an account with limited privileges. Based on the description, the likely attack vector is a network‑based HTTP exploitation by a low‑privileged user.

Generated by OpenCVE AI on October 21, 2026 at 03:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and apply the latest security patch for Oracle HCM Common Architecture 12.2.3‑12.2.15 from the Oracle Security Alerts website (e.g., https://www.oracle.com/security-alerts/cpuoct2026.html).
  • If a patch is not yet available, restrict HTTP access to the HCM Common Architecture to trusted IP ranges or block non‑essential traffic until the update is applied.
  • Review and enforce least‑privilege ACLs for all user accounts to prevent unauthorized creation, deletion, or modification of critical data.

Generated by OpenCVE AI on October 21, 2026 at 03:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Oracle HCM Common Architecture Unauthorized Access and Data Modification
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
First Time appeared Oracle
Oracle hcm Common Architecture
CPEs cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hcm Common Architecture
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Oracle Hcm Common Architecture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:13:47.704Z

Reserved: 2026-09-28T15:40:09.509Z

Link: CVE-2026-101827

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:54.823Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:38.720

Modified: 2026-10-22T16:17:19.770

Link: CVE-2026-101827

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:15:15Z

Weaknesses