{"id":"CVE-2026-83384","kind":"vulnerability","aliases":["CVE-2026-83384"],"related":[],"title":"Oracle E-Business Suite HRMS: low-privilege user can read HR data","description":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"An Oracle E-Business Suite HRMS (US) component, Internal Operations, has a flaw that lets a low-privileged logged-in user reach data beyond their role over HTTP. The sources say an attacker gets unauthorized access to critical HR data, with a CVSS 3.1 score of 6.5 for confidentiality impact only.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hrms","oracle-ebs","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Confirm whether Oracle E-Business Suite HRMS (US) is installed and check the version against the affected range `12.2.3` through `12.2.15`\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name it","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83384 for Oracle E-Business Suite HRMS; the exact patch name is unknown from the sources\n- Move affected instances off the listed versions `12.2.3` to `12.2.15` as Oracle's advisory directs","status":"open","published_at":"2026-10-20T22:19:54+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:35+00:00","updated_at":"2026-10-25T03:51:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:51:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-83384 for Oracle E-Business Suite HRMS; the exact patch name is unknown from the sources\n- Move affected instances off the listed versions `12.2.3` to `12.2.15` as Oracle's advisory directs","reach":"network","title":"Oracle E-Business Suite HRMS: low-privilege user can read HR data","impact":"medium","summary":"An Oracle E-Business Suite HRMS (US) component, Internal Operations, has a flaw that lets a low-privileged logged-in user reach data beyond their role over HTTP. The sources say an attacker gets unauthorized access to critical HR data, with a CVSS 3.1 score of 6.5 for confidentiality impact only.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","hrms","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical HR data beyond their own access","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-83384 to confirm the patch name and any workaround; the NVD entry gives no fix steps.","how_to_check":"- Confirm whether Oracle E-Business Suite HRMS (US) is installed and check the version against the affected range `12.2.3` through `12.2.15`\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name it","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running Oracle E-Business Suite HRMS (US) in the affected 12.2.x range that expose the Internal Operations functions over HTTP to users with low privileges. The sources do not say which configurations or roles are needed beyond a low-privileged account, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":3466,"output_tokens":692,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-83384':17A,20A '/av':157C '12.2.15':105C '12.2.3':104C '3.1':75B,147C,156C '6.5':78B,150C 'access':67B,115C,132C,138C,144C 'affect':102C 'allow':109C 'attack':64B,112C,124C 'base':148C 'beyond':55B 'busi':4A,33B,93C 'complet':137C 'compon':37B,95C 'compromis':119C 'confidenti':80B,151C 'critic':69B,134C 'cve':15A,18A 'cvss':74B,146C,153C,155C 'data':14A,54B,71B,135C,145C 'e':3A,32B,92C 'e-busi':2A,31B,91C 'easili':106C 'eb':24B 'exploit':107C 'flaw':42B 'get':65B 'h/i':163C 'host':27B 'hr':13A,70B 'hrms':6A,21B,35B,86C,121C,142C 'http':59B,117C 'impact':81B,152C 'intern':38B,96C 'l/pr':159C 'l/ui':160C 'let':44B 'log':50B 'logged-in':49B 'low':8A,47B,110C 'low-privileg':7A,46B 'n':165C 'n/a':164C 'n/ac':158C 'n/s':161C 'network':114C 'oper':39B,97C 'oracl':1A,23B,30B,85C,90C,120C,141C 'oracle-eb':22B 'privileg':9A,48B,111C 'product':88C 'reach':53B 'read':12A 'result':129C 'role':57B 'say':62B 'score':76B,149C 'self':26B 'self-host':25B 'sourc':61B 'success':123C 'suit':5A,34B,94C 'support':98C 'u/c':162C 'unauthor':66B,131C 'us':36B,87C,122C,143C 'user':10A,52B 'vector':154C 'vendor':28B 'version':99C 'via':116C 'vulner':82C,108C,127C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite HRMS (US) in the affected 12.2.x range that expose the Internal Operations functions over HTTP to users with low privileges. The sources do not say which configurations or roles are needed beyond a low-privileged account, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83384","severity":null,"published_at":"2026-10-20T22:19:54+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}