---
id: "CVE-2026-83386"
kind: "vulnerability"
aliases: ["CVE-2026-83386"]
title: "Oracle E-Business Suite HRMS: low-privilege users can read HR data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hrms", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:19:54+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:51:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83386", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite HRMS: low-privilege users can read HR data

Oracle HRMS (US) in E-Business Suite releases 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can gain unauthorized access to HR data the product holds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the E-Business Suite release in use is within `12.2.3` to `12.2.15`
- Check whether the HRMS (US) product is installed and reachable over HTTP
- Review Oracle's advisory for the patch level that covers this CVE: unknown

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-83386 for the E-Business Suite HRMS (US) product; the exact patch name is unknown
- Move to a release outside `12.2.3` to `12.2.15` if a patch is not available: unknown

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83386

## From the sources

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_