What is the CVSS score of CVE-2026-61117?

CVE-2026-61117 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle HRMS (UK) CVE-2026-61117

EUVD-2026-47328 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-w9g2-75p9-9qxr

Authentication Bypass Information Disclosure Oracle Human Resources Management System

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

Confirmed network vector with low-privilege requirement and no user interaction; AC:H reflects specific exploitation conditions; scope change with high confidentiality and no integrity or availability impact matches description.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:21 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle HRMS (UK) is the UK-localized Human Resources Management System module within Oracle E-Business Suite (EBS), a large integrated enterprise application suite. The vulnerability resides in the Internal Operations component - an area likely responsible for backend HR data processing or payroll logic specific to UK regulatory requirements. The CVSS Scope:Changed metric (S:C) indicates the flaw crosses a security boundary, meaning exploitation within the HRMS (UK) module can affect data or controls in adjacent EBS components, consistent with EBS's tightly integrated multi-module architecture. The 'Authentication Bypass' tag from EUVD suggests the underlying mechanism allows a low-privileged user to circumvent access controls protecting high-sensitivity HR data. No CWE is assigned by the vendor, which limits root-cause classification; however, the authentication bypass tag combined with S:C and C:H suggests an access control or privilege escalation flaw rather than a memory corruption issue. Affected CPE scope per Oracle's advisory covers EBS versions 12.2.8 through 12.2.15.

RemediationAI

The primary remediation is to apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publish discrete patched version numbers for EBS patches - they are applied as cumulative bundle patches within the 12.2.x stream, so administrators should apply the July 2026 CPU bundle to all affected EBS instances. No exact post-patch version number is independently confirmable from the available data. As a compensating control pending patch application, restrict network access to Oracle EBS Internal Operations endpoints at the application or network layer (WAF rules or perimeter firewall ACLs limiting access to known trusted IP ranges), accepting the trade-off of reduced availability for remote HR staff. Additionally, audit low-privileged user accounts in Oracle HRMS (UK) and remove or deactivate accounts not actively in use to shrink the threat surface for PR:L exploitation. Organizations should monitor EBS application logs for anomalous data access patterns from low-privileged sessions targeting Internal Operations components.