CVE-2026-101825

Received Received - Intake

Oracle HCM Common Architecture Authentication Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-101825

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	Oracle HCM Common Architecture 12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle HCM Common Architecture within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15 and allows a low-privileged attacker with network access to potentially take over the system. The vulnerability has a CVSS score of 7.5, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle HCM Common Architecture versions 12.2.3 to 12.2.15. Inspect Oracle E-Business Suite components via Oracle Enterprise Manager or database queries for version details. Network monitoring for unusual HTTP traffic to HCM components may also help.

Impact Analysis

An attacker could exploit this to gain full control over the Oracle HCM Common Architecture, leading to unauthorized access, data theft, or system disruption. Since it requires low privileges and network access, internal or external attackers could leverage it.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected versions may face compliance failures, legal penalties, and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle E-Business Suite. Restrict network access to HCM components via firewalls. Upgrade to a non-vulnerable version if possible. Monitor for suspicious activity in HCM logs.

Hi! I’m here to help you understand CVE-2026-101825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70