Oracle HRMS (UK) CVE-2026-61117

A low-privileged account with authenticated access to Oracle E-Business Suite via HTTP is required - exploitation is not possible without valid credentials (PR:L from CVSS vector). High attack complexity (AC:H) indicates the attacker must satisfy conditions beyond mere network access, such as specific application state, timing, or parameter combinations in the Internal Operations component; the exact condition is not disclosed by Oracle. Exploitation is constrained to organizations running Oracle HRMS (UK) versions 12.2.8 through 12.2.15 with the Internal Operations component exposed over HTTP. No user interaction from a victim is required once the attacker satisfies the complexity condition. Limiting factors: requires valid low-privilege EBS credentials; AC:H makes automated/mass exploitation less feasible; the UK-specific module significantly narrows the exposed population; network access must reach the EBS application tier.

The CVSS 3.1 base score of 6.3 (Medium) is somewhat suppressed by AC:H, which reflects that exploitation is difficult - requiring specific timing, configuration, or race conditions rather than a trivial one-shot attack. The key risk amplifier is S:C combined with C:H: a successful exploit does not merely expose HRMS data but can reach across EBS module boundaries, potentially exposing payroll, employee PII, and financial records from interconnected modules. PR:L is a meaningful barrier - attackers must hold valid credentials - but in enterprise environments with many HR system users, this is a realistic threat actor profile (insider threat, compromised low-privileged account). EPSS data is not provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The authentication bypass characterization from EUVD raises concern: if the mechanism allows a low-privileged user to escalate data access, the real-world confidentiality impact may be higher than CVSS alone implies. No POC is publicly known, which reduces immediate exploit risk. Overall: prioritize patching in environments where Oracle EBS handles sensitive employee or payroll data, but AC:H and PR:L justify treating this below critical emergency patch thresholds absent KEV confirmation.

An attacker with a low-privileged Oracle EBS account - such as a contractor, former employee with retained credentials, or compromised HR clerk account - crafts HTTP requests targeting a specific state or parameter condition in the Oracle HRMS (UK) Internal Operations component that triggers the authentication bypass logic. Once the access control is circumvented, the attacker retrieves complete HR records, including payroll data, national insurance numbers, and employee PII, and potentially traverses the EBS scope boundary to access data in connected modules. Because AC:H requires specific conditions, the attacker may need reconnaissance or repeated attempts to identify the exact trigger, but no user interaction from a victim is required.