{"id":"CVE-2026-83358","kind":"vulnerability","aliases":["CVE-2026-83358"],"related":[],"title":"Oracle E-Business Suite HRMS Norway: low-privilege user reads HR data","description":"Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's HRMS (Norway) module has a flaw in its Internal Operations component that lets a low-privileged user reach data they should not see. An attacker with a network login and HTTP access can read all HRMS (Norway) data the product holds.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hrms","norway","oracle-ebs","self-hosted","vendor"],"not_affected_if":["no-hrms-norway-module"],"how_to_check":"- Confirm whether Oracle E-Business Suite with the HRMS (Norway) product is installed, and check its version against `12.2.3` through `12.2.15`\n- Check the Oracle Security Alert or Critical Patch Update for the release that covers this CVE: unknown","fix":"- Apply the Oracle Critical Patch Update that covers CVE-2026-83358 for Oracle E-Business Suite 12.2 (exact patch name: unknown)\n- Move Oracle E-Business Suite HRMS (Norway) to a release outside `12.2.3` to `12.2.15` once the vendor patch is available: unknown","status":"open","published_at":"2026-10-20T22:19:52+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:39+00:00","updated_at":"2026-10-25T03:51:39+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:51:39Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers CVE-2026-83358 for Oracle E-Business Suite 12.2 (exact patch name: unknown)\n- Move Oracle E-Business Suite HRMS (Norway) to a release outside `12.2.3` to `12.2.15` once the vendor patch is available: unknown","reach":"network","title":"Oracle E-Business Suite HRMS Norway: low-privilege user reads HR data","impact":"medium","summary":"Oracle E-Business Suite's HRMS (Norway) module has a flaw in its Internal Operations component that lets a low-privileged user reach data they should not see. An attacker with a network login and HTTP access can read all HRMS (Norway) data the product holds.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","hrms","norway","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"low-privileged user reads all HRMS Norway data","analyst_note":"Check the Oracle Security Alert advisory for the patch name and the exact fixed release; the NVD entry does not give them.","how_to_check":"- Confirm whether Oracle E-Business Suite with the HRMS (Norway) product is installed, and check its version against `12.2.3` through `12.2.15`\n- Check the Oracle Security Alert or Critical Patch Update for the release that covers this CVE: unknown","needs_analyst":true,"not_affected_if":["no-hrms-norway-module"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2 with the HRMS (Norway) product, where staff or contractors can log in over HTTP. Sources do not say which configurations expose the Internal Operations component beyond that, so teams without HRMS (Norway) can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":3474,"output_tokens":666,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-83358':17A,20A '/av':153C '12.2.15':101C '12.2.3':100C '3.1':143C,152C '6.5':146C 'access':68B,111C,128C,134C,140C 'affect':98C 'allow':105C 'attack':61B,108C,120C 'base':144C 'busi':4A,33B,89C 'complet':133C 'compon':46B,91C 'compromis':115C 'confidenti':147C 'critic':130C 'cve':15A,18A 'cvss':142C,149C,151C 'data':14A,55B,74B,131C,141C 'e':3A,32B,88C 'e-busi':2A,31B,87C 'easili':102C 'eb':25B 'exploit':103C 'flaw':41B 'h/i':159C 'hold':77B 'host':28B 'hr':13A 'hrms':6A,21B,36B,72B,82C,117C,138C 'http':67B,113C 'impact':148C 'intern':44B,92C 'l/pr':155C 'l/ui':156C 'let':48B 'login':65B 'low':9A,51B,106C 'low-privileg':8A,50B 'modul':38B 'n':161C 'n/a':160C 'n/ac':154C 'n/s':157C 'network':64B,110C 'norway':7A,22B,37B,73B,83C,118C,139C 'oper':45B,93C 'oracl':1A,24B,30B,81C,86C,116C,137C 'oracle-eb':23B 'privileg':10A,52B,107C 'product':76B,84C 'reach':54B 'read':12A,70B 'result':125C 'score':145C 'see':59B 'self':27B 'self-host':26B 'success':119C 'suit':5A,34B,90C 'support':94C 'u/c':158C 'unauthor':127C 'user':11A,53B 'vector':150C 'vendor':29B 'version':95C 'via':112C 'vulner':78C,104C,123C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2 with the HRMS (Norway) product, where staff or contractors can log in over HTTP. Sources do not say which configurations expose the Internal Operations component beyond that, so teams without HRMS (Norway) can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83358","severity":null,"published_at":"2026-10-20T22:19:52+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}