The vulnerability exists in the Person component of Oracle Human Resources and enables an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation requires a human interaction from a user other than the attacker, after which the attacker can take full control over the application, leading to loss of confidentiality, integrity and availability of HR data. The CVSS 3.1 base score of 7.5 indicates a high severity level.

Affected installations include Oracle Human Resources, part of Oracle E‑Business Suite, for versions 12.2.3 through 12.2.15 as specified by the vendor’s advisory.

The EPSS score of less than 1% suggests that exploit attempts are currently rare, but the vulnerability is not listed in KEV yet the requirement for human interaction and a wide network exposure over HTTP raise the overall risk. If exploited, the attacker can assume complete control over the application, potentially bypassing all security controls and exposing or manipulating sensitive personnel data.