Description
Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-07-21
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the install and upgrade component of Oracle iRecruitment. An attacker who possesses only low privileges and network connectivity to the HTTP interface can exploit this flaw, yielding unauthorized insert, update, or delete operations on Oracle iRecruitment data, and may also read a subset of that data. The impact compromises confidentiality and integrity but does not affect availability.

Affected Systems

Oracle Corporation’s Oracle iRecruitment product, versions 12.2.3 through 12.2.15, is affected.

Risk and Exploitability

The CVSS v3.1 score of 5.4 represents moderate severity, with an EPSS score of less than 1% indicating that exploit attempts are rare, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to target the private‑network HTTP endpoint; no elevated privileges or user interaction are required.

Generated by OpenCVE AI on August 4, 2026 at 01:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for iRecruitment 12.2.3–12.2.15
  • Restrict HTTP service access by configuring firewall rules to allow only trusted internal networks
  • Enforce role‑based access controls and least‑privilege principles (CWE‑269 mitigation) for all Oracle iRecruitment users

Generated by OpenCVE AI on August 4, 2026 at 01:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Data Manipulation via HTTP in Oracle iRecruitment

Mon, 27 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Data Manipulation via HTTP in Oracle iRecruitment

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle irecruitment
CPEs cpe:2.3:a:oracle:irecruitment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle irecruitment
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Irecruitment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:22:17.953Z

Reserved: 2026-07-08T15:51:55.611Z

Link: CVE-2026-61064

cve-icon Vulnrichment

Updated: 2026-07-24T14:22:12.515Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:00:12Z

Weaknesses
  • CWE-269

    Improper Privilege Management