CVE-2026-46955: Oracle Human Resources Auth Bypass Flaw

CVE-2026-46955 Overview

CVE-2026-46955 is a high-severity vulnerability in the Oracle Human Resources product of Oracle E-Business Suite, specifically in the Person component. The flaw affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires user interaction from a victim other than the attacker. The vulnerability is categorized under [CWE-79] (Cross-Site Scripting). Successful exploitation results in full takeover of Oracle Human Resources, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation enables complete takeover of Oracle Human Resources, exposing employee personal data and HR business processes to unauthorized modification.

Affected Products

Oracle E-Business Suite Human Resources 12.2.3
Oracle E-Business Suite Human Resources versions 12.2.4 through 12.2.14
Oracle E-Business Suite Human Resources 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46955 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46955

Vulnerability Analysis

The vulnerability resides in the Person component of Oracle Human Resources within Oracle E-Business Suite. The weakness is classified as Cross-Site Scripting (XSS) per [CWE-79]. An unauthenticated attacker delivers a crafted HTTP request containing malicious script content. When a legitimate user interacts with the resulting page, the injected script executes within the user's authenticated session context.

The attack complexity is high, indicating non-trivial conditions must be satisfied. The vulnerability requires user interaction, meaning an attacker must lure a victim into clicking a crafted link or visiting an attacker-controlled resource. The EPSS data reports a probability of 0.151%, reflecting limited observed exploitation activity at this time.

Root Cause

The root cause is improper neutralization of user-supplied input within the Person component before it is reflected or stored in HTML output rendered by Oracle Human Resources. Insufficient output encoding allows attacker-controlled script content to be interpreted by the browser as executable code rather than inert data.

Attack Vector

The attack vector is network-based over HTTP. An attacker crafts a URL or payload targeting the vulnerable Person component endpoint and delivers it to an authenticated Oracle Human Resources user, typically through phishing or a malicious link. When the victim interacts with the payload, the injected script executes in their browser with the privileges of their HR session. This permits session hijacking, action forgery on behalf of the victim, and full compromise of the Oracle Human Resources module.

No public proof-of-concept code is currently available for this issue. Refer to the Oracle Security Alert June 2026 for vendor technical details.

Detection Methods for CVE-2026-46955

Indicators of Compromise

HTTP requests to Oracle Human Resources Person component URLs containing script tags, JavaScript event handlers, or URL-encoded payloads such as %3Cscript%3E.
Anomalous outbound requests from HR user browsers to attacker-controlled domains immediately after accessing Oracle E-Business Suite.
Unexpected session token usage, including HR session reuse from multiple geographic locations within a short time window.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for reflected script payloads in query parameters and form data targeting Oracle HR endpoints.
Correlate user-agent strings, referrer headers, and request bodies for the Person component to identify crafted requests originating from phishing campaigns.
Deploy Content Security Policy (CSP) violation reporting to surface unauthorized script execution in HR pages.

Monitoring Recommendations

Forward Oracle E-Business Suite access logs and WAF events into a centralized SIEM for retention and analytic correlation.
Alert on HR account activity that follows a clicked external link within five minutes, indicating potential XSS-driven session abuse.
Track configuration and personnel record changes performed by privileged HR accounts and flag changes performed outside normal business hours.

How to Mitigate CVE-2026-46955

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert June 2026 to all Oracle E-Business Suite instances running Human Resources versions 12.2.3 through 12.2.15.
Restrict external network exposure of Oracle E-Business Suite interfaces to trusted networks and VPN users only.
Notify HR end users of phishing risks targeting Oracle HR sessions and reinforce link-handling procedures.

Patch Information

Oracle has released fixes as part of the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert June 2026 advisory, identify the corresponding patch for their Oracle E-Business Suite release, and apply it according to Oracle's documented patching procedures for R12.2.

Workarounds

Place a WAF in front of Oracle E-Business Suite with rules that block reflected XSS payloads targeting the Person component.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the Oracle application origin.
Limit Oracle Human Resources access to authenticated users on internal networks using network segmentation and access control lists until patches are deployed.

bash

# Example WAF rule (ModSecurity) blocking common XSS payloads on Oracle HR Person endpoints
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,deny,status:403,id:1026046955,msg:'Potential XSS targeting Oracle HR Person component'"
  SecRule ARGS|REQUEST_HEADERS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"