Oracle HRMS (India) of Oracle E‑Business Suite contains a flaw that allows an attacker with low privileges and network connectivity to HTTP that reaches the service to read confidential data. The vulnerability is not tied to user interface interaction but can be triggered by sending a crafted HTTP request. The result is a breach of confidentiality for all accessible HRMS data, and the attacker could potentially view or export sensitive employee information.

Affected are Oracle HRMS (India) versions 12.2.3 through 12.2.15. This includes all installations of the Indian Payroll component in the Oracle E‑Business Suite environment that have been released up to the 12.2.15 update.

The CVSS base score of 6.5 indicates a moderate severity with high confidentiality impact. EPSS score is < 1%, and the vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog, suggesting no widespread public exploitation observed yet. The vector (AV:N/AC:L/PR:L/UI:N) indicates the attack can proceed over the network, requires low privileged authentication, and needs no user interaction. Low effort to exploit combined with the lack of pre-existing mitigations many environments means the risk remains significant for premises that expose HRMS services to untrusted networks.