CVE-2026-83491: Oracle iRecruitment physical network access vulnerability

CVE-2026-83491 · Severity: medium · CVSS 6.8 · Published 2026-09-15

Oracle iRecruitment is a recruitment and applicant tracking system within Oracle E-Business Suite used by large enterprises to manage hiring. This vulnerability allows an attacker with physical access to the network segment where the system operates to bypass authentication and read, modify, or delete recruitment data without authorization. While the attack requires physical network access (a less common threat), successful exploitation could expose sensitive candidate information and disrupt hiring operations.

Technologies: Oracle iRecruitment. Vendors: Oracle.

Quick answers

Is CVE-2026-83491 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83491 being exploited in the wild.
How severe is CVE-2026-83491?
Medium severity, with a CVSS score of 6.8, published 15 September 2026.
Which products and versions are affected?
Oracle iRecruitment 12.2.3-12.2.15.
Is there a fix for CVE-2026-83491?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83491 attacked?
It is attacked with physical access, in a hosted service.
Am I affected by CVE-2026-83491?
Check whether you run Oracle iRecruitment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a difficult-to-exploit vulnerability in Oracle iRecruitment (versions 12.2.3 through 12.2.15) accessible to unauthenticated attackers with physical access to the adjacent network segment. The vulnerability allows unauthorized read and write access to critical data stored in iRecruitment. Attack vector requires the attacker to be on the same physical communication segment (network) as the affected system, with no authentication or user interaction required once network access is obtained. Successful exploitation results in confidentiality and integrity compromise of recruitment data. Patch availability from Oracle is assumed but not confirmed in the provided advisory.

Affected products

  • Oracle iRecruitment 12.2.3-12.2.15

Timeline

  • 2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.