Description

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:17:30.173Z",
  "pubdate": "2026-08-18T21:17:30.173Z",
  "executiveSummary": "A remotely exploitable vulnerability affects the Oracle HCM Common Architecture component of Oracle E-Business Suite, specifically within the Knowledge Integration feature across supported versions 12.2.3 through 12.2.15. This security flaw enables unauthenticated threat actors with network access via HTTP to compromise the affected application without requiring user interaction or prior privileges.\nSuccessful exploitation of this vulnerability yields severe security implications, leading to unauthorized read access to critical and sensitive data, as well as complete access to all data accessible by the Oracle HCM Common Architecture. Additionally, attackers can achieve unauthorized update, insert, or delete capabilities against a subset of accessible data, severely undermining data integrity within the enterprise environment.\nWith a CVSS 3.1 Base Score of 8.2 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, the vulnerability highlights significant risks regarding confidentiality and integrity. The low attack complexity and lack of authentication requirements mean that any network-adjacent or internet-exposed instance running vulnerable versions is at immediate risk of compromise if appropriate security controls or vendor patches are not applied.",
  "technicalDetails": "The vulnerability resides in the Knowledge Integration component of the Oracle HCM Common Architecture within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The root cause stems from insufficient access controls, input validation, or authorization enforcement within network-accessible HTTP endpoints exposed by the affected component.\nAttackers exploit this vulnerability by sending specially crafted HTTP requests directly to the vulnerable Knowledge Integration endpoints. Because the component fails to properly authenticate incoming requests or enforce strict privilege boundaries, the system processes the malicious input as a legitimate administrative or user transaction.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies an exposed Oracle E-Business Suite instance running a vulnerable version of Oracle HCM Common Architecture. Second, the attacker leverages network access via the HTTP protocol to interact directly with the vulnerable Knowledge Integration interface. Third, by submitting crafted payloads, the attacker bypasses missing access checks, allowing unauthorized interaction with the underlying architecture.\nPost-exploitation impacts are characterized by severe data compromise. The attacker gains high-level confidentiality impact, enabling the retrieval of critical data and complete extraction of information accessible to the Oracle HCM Common Architecture. Furthermore, the attacker achieves low-to-moderate integrity impact, permitting unauthorized modifications, insertions, or deletions of specific data sets within the architecture.\nThe technical parameters governing this vulnerability include network attack vector (AV:N), low attack complexity (AC:L), requiring zero privileges (PR:N), and demanding no user interaction (UI:N). The scope remains unchanged (S:U), concentrating the adverse effects strictly on confidentiality (C:H) and integrity (I:L) while leaving availability unimpacted (A:N)."
}