Oracle HRMS (UK) of Oracle E-Business Suite contains a vulnerability that an attacker with low privileges and network reachability via HTTP can exploit. The flaw allows the attacker to perform unauthorized update, insert, or delete operations, and to read a subset of data that the HRMS system exposes. The CVSS v3.1 score of 5.4 reflects moderate confidentiality and integrity impact; availability is not affected. Successful exploitation requires a user to cooperate, and although the issue is in Oracle HRMS (UK) the attack may also affect other products in the suite.

Vendors: Oracle Corporation. Product: Oracle HRMS (UK) component: Internal Operations, Oracle E‑Business Suite. Affected versions are 12.2.3 through 12.2.15.

The CVSS v3.1 base score of 5.4 indicates moderate confidentiality and integrity impacts without affecting availability. Attackers with low privileges who can reach the HRMS HTTP endpoints can exploit the flaw, but exploitation requires a user other than the attacker to interact with the system. The EPSS of 0.213% reflects a very low but non‑zero likelihood of exploitation in the wild. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of widespread active exploitation. Nevertheless, the potential to perform unauthorized updates, inserts, deletes, or read sensitive HRMS data warrants prompt remediation.