What is the CVSS score of CVE-2026-61036?

CVE-2026-61036 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Oracle HRMS Norway CVE-2026-61036

EUVD-2026-47254 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7r3h-wgcv-2j5j

Authentication Bypass Oracle Human Resources Management System

3.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.8 LOW

PR:H confirmed by description; C:L and I:L match partial data access impact; A:N as no availability impact stated.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:32 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Norway) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.

Technical ContextAI

Oracle HRMS (Norway) is a country-specific human resources and payroll management module within Oracle E-Business Suite (EBS), designed for Norwegian payroll regulatory compliance. The affected CPE-implied product range spans EBS release 12.2.3 through 12.2.15. The attack surface is the HTTP interface of the Norway Payroll component, accessible over the network. CWE classification is not assigned by NVD for this entry, making root cause class indeterminate from available data. The 'Authentication Bypass' tag reported in EUVD intelligence conflicts with the CVSS PR:H metric, suggesting the issue may be an authorization control bypass (privilege boundary violation within an authenticated session) rather than a true authentication bypass - this distinction is unconfirmed from the advisory text alone. The scope is unchanged (S:U), meaning exploitation does not enable lateral movement to other EBS components or systems.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for all affected EBS components, and the fix version should be obtained through Oracle Support (My Oracle Support patch delivery). An exact standalone patch version is not independently confirmed from the available data - consult the July 2026 CPU patch matrix for the applicable patch number for EBS 12.2.x. As a compensating control prior to patching, restrict network access to the Oracle EBS Norway Payroll component to only authorized high-privilege users and enforce least-privilege principles on EBS application accounts to reduce the viable attacker population. Disabling the Norway Payroll component entirely is an option only for organizations that do not use it, with the trade-off of interrupting payroll processing for Norwegian operations.