A vulnerability exists in Oracle HRMS (US), specifically the US Payroll Year End component, that permits a low‑privileged attacker with HTTP network access to perform unauthorized updates, inserts, or deletes, as well as read limited data. Successful exploitation requires a user interaction from someone other than the attacker, indicating a user‑interaction requirement (UI:R). The impact is a modest compromise of confidentiality and integrity, rated as low on both dimensions in the CVSS vector.

Oracle Corporation’s Oracle HRMS (US) versions 12.2.3 through 12.2.15 are affected. The vulnerability is located in the US Payroll Year End functionality of the Oracle E‑Business Suite.

The CVSS base score is 5.4, classifying the vulnerability as medium severity. The EPSS score of <1% indicates a very low probability that this vulnerability will be actively exploited, and the issue is not listed in the CISA KEV catalog. Exploitation is feasible over the network via HTTP and depends on a separate, human user to interact with the system, meaning a real‑world attack would likely involve social engineering or phishing. Because the CVSS vector includes a scope change, successful exploitation could potentially affect other product components beyond Oracle HRMS (US).