Live › vulnerability › CVE-2026-83384
Go to dashboardAn Oracle E-Business Suite HRMS (US) component, Internal Operations, has a flaw that lets a low-privileged logged-in user reach data beyond their role over HTTP. The sources say an attacker gets unauthorized access to critical HR data, with a CVSS 3.1 score of 6.5 for confidentiality impact only.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running Oracle E-Business Suite HRMS (US) in the affected 12.2.x range that expose the Internal Operations functions over HTTP to users with low privileges. The sources do not say which configurations or roles are needed beyond a low-privileged account, so the exact exposure is unknown.
No product ranges from the sources yet.
12.2.3 through 12.2.1512.2.3 to 12.2.15 as Oracle's advisory directsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-83384")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.