Vulnerability in Oracle HRMS (India) allows a local attacker with minimal privileges to compromise the application. The flaw enables unauthorized access to critical HR data and can extend to other components through a scope change. This is a local privilege escalation issue that directly impacts confidentiality, with no integrity or availability effects reported.

Oracle Corporation’s Oracle HRMS (India), specifically the Indian Payroll component, is affected for versions 12.2.3 through 12.2.15.

CVSS base score 6.5 indicates moderate severity; the attack vector is local. The attacker’s low privilege requirement and low attack complexity make exploitation straightforward for a host‑bound threat actor. The EPSS score of < 1% shows a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The scope change increases risk because compromise can spread to other Oracle E‑Business Suite components. Operators should consider immediate patching or mitigation.