CVE-2026-83371 in HRMS (UK)
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Internal Operations component of Oracle HRMS for the United Kingdom region, which is part of the broader Oracle E-Business Suite platform. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect allows a low-privileged attacker to exploit the system via network access using the HTTP protocol. While the vulnerability is technically located within the HRMS module, its exploitation can lead to significant scope changes by impacting additional products within the enterprise environment. This characteristic highlights the interconnectedness of modules in complex ERP systems and underscores how a localized flaw can have wider organizational consequences.
From a technical perspective, this vulnerability represents an authorization bypass or improper access control issue that permits unauthorized data manipulation. The attack vector requires human interaction from a user other than the attacker, indicating that social engineering tactics may be necessary to trigger the exploit. Once triggered, the vulnerability enables the attacker to perform unauthorized updates, inserts, and deletes on accessible HRMS data. Additionally, it grants unauthorized read access to a specific subset of this data. This combination of integrity and confidentiality impacts suggests that sensitive employee information or payroll details could be altered or exfiltrated without proper authentication checks being enforced correctly during these operations.
The operational impact of this vulnerability is substantial due to the sensitivity of human resources data. Unauthorized modifications can lead to incorrect payroll processing, fraudulent changes to employee records, or disruption of internal workflows. The ability to read sensitive subsets of data poses a direct threat to privacy regulations such as GDPR in Europe and other regional compliance frameworks. Furthermore, because successful attacks may impact additional products beyond HRMS, the integrity of related financial or operational modules could also be compromised, leading to broader systemic instability and potential regulatory fines for non-compliance with data protection standards.
In terms of industry classification, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-798 Use of Hard-coded Credentials if the low privilege level is insufficiently restricted by default configurations. The requirement for human interaction places it within the context of ATT&CK technique T1534 Internal Spearphishing, as attackers would likely need to deceive an internal user into performing a specific action that triggers the backend logic flaw. Organizations should prioritize patching affected systems to version 12.2.16 or later where available. Implementing strict input validation and enforcing principle of least privilege across all HTTP endpoints is critical for mitigating similar risks in legacy enterprise applications.