CVE-2026-46955: Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person)

Synopsis

An unauthenticated network-exploitable vulnerability affects the Person component of Oracle Human Resources in Oracle E-Business Suite versions 12.2.3 through 12.2.15. An attacker who can reach the application over HTTP and induce a user to interact with a crafted request can trigger the flaw without holding any account credentials, though the attack requires both victim interaction and favorable conditions to succeed. Successful exploitation results in full takeover of the Oracle Human Resources instance, giving the attacker control over confidentiality, integrity, and availability of the application. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will surface a patched rebuild the moment an upstream fix becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Human Resources application over the network via HTTP; the service must be exposed to the attacker's network position.

• AuthenticationNot required

  No account credentials are needed; the attacker can interact with the vulnerable endpoint as an unauthenticated user.

• Victim interactionRequired

  A person other than the attacker must take an action (such as clicking a crafted link or visiting a malicious page) for the attack to succeed.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker depends on race conditions, specific environmental state, or other factors outside their direct control, making reliable exploitation harder to achieve.

Blast Radius

• Reads all data stored in the Oracle Human Resources instance, including employee personal records, compensation data, and HR documents.
• Modifies or deletes HR records, organizational data, and user configurations persisted in the application.
• Crashes or destabilizes the Oracle Human Resources service, denying access to HR functions across the organization.
• Achieves full application takeover, enabling the attacker to pivot further within the E-Business Suite environment.