CVE-2026-46955 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Human Resources, specifically versions 12.2.3-12.2.15, should prioritize patching this vulnerability to prevent potential takeovers. IT administrators, security teams, and risk management professionals should be aware of this vulnerability and take necessary actions to mitigate the risk. Additionally, operators and platform administrators should review system configurations and ensure that all necessary security patches are applied.

Technical summary

The vulnerability is located in the Person component of Oracle Human Resources and has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. It is considered difficult to exploit and requires human interaction from a person other than the attacker. Successful attacks can result in confidentiality, integrity, and availability impacts. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Human Resources, and a CVSS score of 7.5 indicates high severity.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by Oracle Corporation as soon as possible
• Restrict access to Oracle Human Resources to only necessary personnel
• Monitor for suspicious activity and implement additional security controls
• Review and update incident response plans to address potential takeovers
• Conduct a thorough review of system configurations and ensure that all necessary security patches are applied
• Implement additional monitoring and logging to detect potential security incidents
• Review and update asset inventory to ensure that all affected systems are accounted for

Evidence notes

The CVE record was published on 2026-06-17T10:54:14.637Z and was last modified on 2026-06-18T20:58:26.793Z. The NVD entry is currently Analyzed. The vulnerability is described in the Oracle Security Alert for June 2026. The evidence is limited, and defenders should verify the affected scope and severity with the vendor advisory.

Official resources