Executive brief
A vulnerability exists in the Enterprise Command Center component of Oracle Human Resources, a module within the Oracle E-Business Suite used for managing workforce data. An attacker with basic user credentials can exploit this flaw over the network to gain unauthorized access to sensitive HR records. This could lead to the theft of personal employee information or the unauthorized modification and deletion of critical business data.
Technical details
A vulnerability in the Enterprise Command Center component of Oracle Human Resources (Oracle E-Business Suite) allows for unauthorized data access and modification. The flaw is easily exploitable by a low-privileged attacker with network access via HTTP. Successful exploitation grants the attacker the ability to create, delete, or modify critical data, as well as gain full read access to all data accessible by the Oracle Human Resources module. The vulnerability affects versions 12.2.14 and 12.2.15. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Human Resources (Enterprise Command Center) 12.2.14, 12.2.15
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update published