Description
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Disclosure
Action: Apply Patch
AI Analysis

Impact

This flaw allows a low‑privileged attacker who can reach the Oracle HRMS (UK) web interface to gain unauthorized update, insert or delete rights to certain HRMS data, and read a subset of that data. The vulnerability requires user interaction from a person other than the attacker and is exploitable via normal HTTP traffic. The described impact includes both confidentiality and integrity violations, and the scope may extend to other products in the E‑Business Suite in a scope‑changing manner.

Affected Systems

Oracle Corporation’s Oracle HRMS (UK) product within the Internal Operations component is affected. All supported releases from 12.2.3 through 12.2.15 contain the vulnerability.

Risk and Exploitability

The CVSS v3.1 base score of 5.4 reflects moderate severity, with low attack complexity and low privilege but user interaction needed. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network‑based via HTTP, and because the flaw allows data alteration and disclosure to a low‑privileged user, the risk remains significant for organizations that rely on these HRMS services.

Generated by OpenCVE AI on October 21, 2026 at 06:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify and install the latest Oracle HRMS (UK) security patches that address the identified flaw, ensuring the system is upgraded beyond version 12.2.15.
  • Restrict HTTP access to the HRMS interface to trusted internal networks and enforce strong authentication, thereby reducing the opportunities for user‑interaction‑driven exploitation.
  • Review and enforce least‑privilege permissions within HRMS, removing unnecessary administrative rights and ensuring users have only the access they require.

Generated by OpenCVE AI on October 21, 2026 at 06:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Title Oracle HRMS (UK) Unauthorized Data Access via HTTP With User Interaction
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T13:14:22.025Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83371

cve-icon Vulnrichment

Updated: 2026-10-27T13:14:10.953Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:53.230

Modified: 2026-10-27T14:17:01.827

Link: CVE-2026-83371

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:15:11Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control