Oracle HRMS Norway CVE-2026-61036

Exploitation requires a high-privileged authenticated user account (PR:H) with network access to the Oracle E-Business Suite HTTP interface. The attacker must operate within an EBS 12.2.3-12.2.15 deployment that includes the Oracle HRMS Norway Payroll component. No user interaction by a third party is required. Exploitation is limited to organizations running Oracle EBS with the Norway-specific HRMS module enabled, which is a non-default, country-specific configuration absent in most global EBS deployments. The 'Authentication Bypass' tag from EUVD suggests some authorization control may be circumventable, but the PR:H CVSS vector explicitly requires the attacker to already hold high-level credentials - unauthenticated exploitation is not supported by the available data. Impact is bounded to partial read and write access on Norway Payroll data only; no availability impact and no cross-system scope change limits the blast radius significantly.

Real-world risk is low. The CVSS 3.1 score of 3.8 (Low) is consistent with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N: while the network attack vector and low complexity nominally suggest broad reachability, the high privilege requirement (PR:H) substantially narrows the realistic attacker population to credentialed insiders or compromised high-privilege accounts. The impact is limited - only partial confidentiality and integrity effects on a subset of Norway Payroll data, with no availability impact and no scope change. No EPSS data was provided, preventing exploitation probability quantification. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, indicating no confirmed active exploitation. The 'Authentication Bypass' tag is a conflicting signal: if the flaw genuinely bypasses authentication, PR:H may be overstated and risk could be higher; however, no evidence supports re-rating the vector beyond what the vendor published. Overall, this represents a low-priority finding for most organizations - internal threat actors or lateral-movement scenarios in Oracle EBS environments warrant the primary concern.

An attacker holding high-privileged credentials within an Oracle E-Business Suite 12.2.x deployment - such as a payroll administrator or a compromised service account - sends crafted HTTP requests to the Norway Payroll component's exposed endpoints. By exploiting the authorization control weakness, the attacker reads payroll records beyond their intended access scope or inserts, updates, or deletes payroll entries without proper authorization. No public proof-of-concept exploit has been identified, and the attack is constrained to organizations running Oracle EBS 12.2.3-12.2.15 with the Norway Payroll module active.