Description
Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Public Sector Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in Oracle Public Sector Human Resources allows a low‑privileged attacker with network access via HTTP to create, delete or modify critical records. The vulnerability can also be leveraged to obtain unauthorized access to all data exposed by the application, leading to significant confidentiality and integrity violations.

Affected Systems

Oracle Public Sector Human Resources, a component of Oracle E‑Business Suite, is affected. Supported releases from 12.2.3 through 12.2.15 are vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 8.1 indicates high severity. The EPSS score is below 1%, suggesting limited current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Exploitation requires only HTTP network reachability and low privilege, meaning that attackers with basic network access could abuse the vulnerability without higher rights.

Generated by OpenCVE AI on August 5, 2026 at 01:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Public Sector Human Resources to the latest version or apply the most recent patch from Oracle.
  • Restrict HTTP access to the application to authorized networks or enforce VPN usage to reduce exposure.
  • Disable or limit the Regression Testing component if it is not required, as the flaw originates in this area.
  • Implement strict role‑based access controls to ensure that only privileged users can modify critical data.

Generated by OpenCVE AI on August 5, 2026 at 01:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Access in Oracle Public Sector Human Resources
Weaknesses CWE-284

Tue, 04 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Allows Unauthorized Data Modification in Oracle Public Sector Human Resources
Weaknesses CWE-284

Thu, 30 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Allows Unauthorized Data Modification in Oracle Public Sector Human Resources
Weaknesses CWE-284

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Vulnerability in Oracle Public Sector Human Resources Allowing Unauthorized Data Modification
Weaknesses CWE-284

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Vulnerability in Oracle Public Sector Human Resources Allowing Unauthorized Data Modification
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Public Sector Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle public Sector Human Resources
CPEs cpe:2.3:a:oracle:public_sector_human_resources:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle public Sector Human Resources
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle E-business Suite Public Sector Human Resources
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:19:49.114Z

Reserved: 2026-07-08T15:51:55.604Z

Link: CVE-2026-60966

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:30.673

Modified: 2026-08-06T15:01:19.900

Link: CVE-2026-60966

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T01:30:17Z

Weaknesses