Oracle HRMS France CVE-2026-60344

The attacker must hold a valid low-privileged account on the Oracle E-Business Suite instance (PR:L per CVSS vector), with HTTP network access to the EBS web application tier. The target system must have the Oracle HRMS (France) localization deployed with the French HR Payroll component active - organizations running EBS without the France-specific HRMS module are not affected. The affected version range is strictly 12.2.3 through 12.2.15; deployments outside this range are not confirmed vulnerable. No user interaction by a victim is required (UI:N). The scope of impact is unchanged (S:U), meaning exploitation is confined to the Oracle HRMS (France) data accessible through the payroll component. The primary constraint limiting exploitation is the requirement for an existing authenticated EBS session - unauthenticated external attackers cannot directly exploit this vulnerability.

The CVSS 3.1 base score of 5.4 (Medium) captures partial confidentiality and integrity impact (C:L/I:L) with no availability impact, low attack complexity (AC:L), and a low privilege requirement (PR:L) over the network. These metrics accurately reflect ease of exploitation - any authenticated EBS user could potentially trigger this. The 'Authentication Bypass' tag from EUVD intelligence is a notable escalating signal: it implies the vulnerability may enable lateral privilege movement within the application, allowing a low-privileged user to transcend their intended data scope, which is particularly concerning in a payroll context. No EPSS score was provided in the input data; its absence prevents probabilistic exploitation forecasting. No CISA KEV listing and no public POC exist at time of analysis, suggesting exploitation has not been observed at scale or weaponized publicly. However, the wide version range (12.2.3-12.2.15) means many enterprise deployments across large organizations using Oracle EBS with French HR operations fall within scope. The unchanged scope (S:U) and low complexity (AC:L) mean that exploitation requires minimal sophistication. Real-world priority should be elevated above what CVSS alone suggests due to the sensitivity of payroll data and the breadth of affected versions.

An attacker with a valid but low-privileged Oracle E-Business Suite account - such as an employee self-service user or a help-desk operator - crafts an HTTP request targeting the French HR Payroll component, exploiting the insufficient authorization check to access payroll records outside their permitted scope. The attacker reads salary information for other employees or manipulates payroll entries, with no victim interaction required. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) and straightforward network vector mean any technically aware insider or compromised low-privilege account could attempt exploitation.