What is the CVSS score of CVE-2026-61119?

CVE-2026-61119 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle HRMS are affected by CVE-2026-61119?

Oracle E-Business Suite HRMS (UK) in versions 12.2.3 through 12.2.15 contains a vulnerability allowing any authenticated user to tamper with critical payroll and HR records, directly threatening…

How to fix or mitigate CVE-2026-61119?

Within 24 hours, audit access logs to identify all users with EBS access and enumerate which low-privileged accounts have accessed HRMS modules; concurrently, engage Oracle support to confirm your organization's affected versions and patch timeline. Within 7 days, implement network-level restrictions limiting HRMS HTTP access to trusted IP ranges and authorized personnel only, and enable comprehensive audit logging of all HRMS data modifications for forensic review. Within 30 days, formulate a remediation plan including: request Oracle's patch timeline for versions 12.2.3-12.2.15, evaluate accelerated upgrade paths, and deploy application-layer compensating controls such as workflow approvals for payroll modifications and separation of duties to prevent single-user tampering.

Oracle HRMS CVE-2026-61119

EUVD-2026-47329 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mw4w-85fp-c3wr

Authentication Bypass Denial Of Service Oracle Human Resources Management System

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network-reachable HTTP with no user interaction (AV:N/UI:N), low complexity, but requires an existing low-privilege EBS account (PR:L); high integrity, partial availability, no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (UK) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (UK). CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

AnalysisAI

Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.

Technical ContextAI

Oracle HRMS (UK) is the United Kingdom localization of Oracle's Human Resources Management System, delivered as a module within Oracle E-Business Suite; the affected code is specifically the UK Payroll component. EBS is a large web-based ERP platform whose modules are reached over HTTP through the EBS application tier (Oracle HTTP Server / WebLogic front end) against a shared Oracle database. Because the flaw permits unauthorized modification of 'critical data or all Oracle HRMS (UK) accessible data,' the root cause is most consistent with a broken access control / missing authorization check (CWE-862/CWE-284 class) in a payroll servlet or page, though the CWE was not populated (N/A) in the source data and cannot be confirmed. No CPE strings were supplied; affected products are identified only from the Oracle CPU text and the ENISA EUVD record.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle addresses EBS flaws through cumulative CPU patches applied to the 12.2 application tier, so install the current CPU patch level for your EBS 12.2 release rather than a single point version - an exact standalone fix version was not published in the source data (Patch available per vendor advisory). Until patching, reduce exposure by tightening HRMS/Payroll responsibility and menu assignments so only trusted staff hold accounts that can reach the UK Payroll functions (this directly counters the PR:L requirement, at the cost of an administrative review of role grants), and restrict network reachability of the EBS application tier to trusted corporate networks/VPN rather than exposing it to the broader internet (may inconvenience remote or self-service users). Increase auditing on payroll data changes to detect unauthorized modification while the patch is scheduled.