Oracle HRMS CVE-2026-61119

Exploitation requires a valid low-privilege account on the target Oracle E-Business Suite instance (CVSS PR:L) with HTTP access to the Oracle HRMS (UK) application tier - it is NOT anonymous or unauthenticated. The affected deployment must be running EBS 12.2.3-12.2.15 with the UK Payroll component of Oracle HRMS installed and reachable. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a low-privilege account and network path exist, no special configuration toggle is required. Limiting factors: the mandatory pre-existing authenticated account, the UK-localized Payroll module must actually be deployed (a UK-specific HRMS install, not universal across all EBS customers), and network reachability of the EBS tier to the attacker.

The signals are moderate and internally consistent rather than alarming. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) shows a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high integrity impact but no confidentiality loss and only partial availability impact - hence the 7.1 base score. The critical mitigating factor is PR:L: the attacker must already hold a valid (even minimal) EBS/HRMS account, which limits this to insiders or attackers who have already obtained credentials, not anonymous internet attackers. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; the absence of KEV and public exploit code suggests this is not under active exploitation. Net: a real integrity concern for organizations running EBS with many low-trust payroll users, but not an emergency 'drop everything' issue - prioritize within the normal Oracle CPU patch cycle unless untrusted users have HRMS access.

A disgruntled employee or a contractor holding a low-privilege Oracle EBS account - or an external attacker who has phished such credentials - sends crafted HTTP requests to the UK Payroll functions of Oracle HRMS. Exploiting the missing authorization check, they modify or delete critical payroll records (for example altering pay or bank details) and can partially disrupt the HRMS service. No public POC is known, but the low attack complexity means a knowledgeable insider could reproduce it with standard browser/HTTP tooling.