---
id: "CVE-2026-83384"
kind: "vulnerability"
aliases: ["CVE-2026-83384"]
title: "Oracle E-Business Suite HRMS: low-privilege user can read HR data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hrms", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-20T22:19:54+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:51:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83384", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite HRMS: low-privilege user can read HR data

An Oracle E-Business Suite HRMS (US) component, Internal Operations, has a flaw that lets a low-privileged logged-in user reach data beyond their role over HTTP. The sources say an attacker gets unauthorized access to critical HR data, with a CVSS 3.1 score of 6.5 for confidentiality impact only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Oracle E-Business Suite HRMS (US) is installed and check the version against the affected range `12.2.3` through `12.2.15`
- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE; the sources do not name it

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-83384 for Oracle E-Business Suite HRMS; the exact patch name is unknown from the sources
- Move affected instances off the listed versions `12.2.3` to `12.2.15` as Oracle's advisory directs

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83384

## From the sources

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_