Description
Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HR Intelligence accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HR Intelligence. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-09-15
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and denial of service
Action: Apply patch
AI Analysis

Impact

The flaw in Oracle HR Intelligence allows an attacker with low privileges and network access via HTTP to create, delete, or modify critical data and to cause the application to hang or crash repeatedly. The vulnerability is classified as improper access control (CWE-284) and can lead to significant integrity and availability damage.

Affected Systems

Oracle HR Intelligence, a component of Oracle E‑Business Suite Internal Operations. Versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS 3.1 Base Score of 6.8 highlights medium overall risk with high impact on integrity and availability. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker to be able to reach the Oracle HR Intelligence service over the network and to authenticate as a low‑privileged user, after which the attacker can perform unauthorized data operations or trigger a denial of service.

Generated by OpenCVE AI on September 17, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any Oracle‑released patch or upgrade Oracle HR Intelligence to a non‑affected version.
  • Restrict HTTP access to Oracle HR Intelligence by limiting inbound IP ranges and implementing role‑based access controls so only authorized users can execute privileged operations.
  • Monitor application logs for unauthorized creation, deletion, or modification actions and configure alerts for repeated crashes or hangs to detect potential exploitation attempts.

Generated by OpenCVE AI on September 17, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Data Manipulation and Denial of Service in Oracle HR Intelligence

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HR Intelligence accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HR Intelligence. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle hr Intelligence
CPEs cpe:2.3:a:oracle:hr_intelligence:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hr Intelligence
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Hr Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T17:59:00.949Z

Reserved: 2026-08-31T15:40:57.338Z

Link: CVE-2026-83076

cve-icon Vulnrichment

Updated: 2026-09-16T17:55:47.678Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:17.257

Modified: 2026-09-16T19:40:00.317

Link: CVE-2026-83076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T03:23:44Z

Weaknesses