The vulnerability in Oracle HCM Common Architecture allows an unauthenticated attacker who can reach the HTTP interface to bypass authentication and gain unauthorized access to all data accessible through the system. Successful exploitation may result in the disclosure of critical data. The CVSS vector indicates a high confidentiality impact (C:H).

Affected product is Oracle HCM Common Architecture, part of Oracle E-Business Suite. Versions 12.2.3 through 12.2.15 are affected.

The CVSS score of 7.5 indicates a high severity. The EPSS score of < 1% indicates a very low exploitation probability, although the vulnerability is described as easily exploitable. It is not listed in the CISA KEV catalog. The attack vector is likely an unauthenticated HTTP request to the service, with no user privileges required. Because the data can be read and accessed in full, the confidentiality risk is significant.