What is the CVSS score of CVE-2026-61120?

CVE-2026-61120 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle HRMS are affected by CVE-2026-61120?

Oracle HRMS within E-Business Suite contains a vulnerability enabling complete application compromise, exposing sensitive employee records and payroll data managed by the HR system.

How to fix or mitigate CVE-2026-61120?

Within 24 hours, conduct an access review of all Oracle E-Business Suite HRMS users, restrict low-privileged account access to the Internal Operations component, and enable enhanced audit logging for HRMS activity and administrative functions. Within 7 days, implement network segmentation to limit HRMS access to authorized personnel only, strengthen authentication controls where feasible, and document a complete access inventory of HRMS application users. Within 30 days, actively monitor Oracle security advisories for patch releases addressing CVE-2026-61120, develop a comprehensive long-term mitigation strategy if patches remain unavailable, and evaluate whether restricting or disabling non-essential HRMS functionality is necessary to further reduce the attack surface.

Oracle HRMS CVE-2026-61120

EUVD-2026-47330 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-gjgh-v4gm-fwpm

Privilege Escalation Oracle Human Resources Management System

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local authenticated low-privileged user (AV:L/PR:L), Oracle-stated difficulty gives AC:H, and full module takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle HRMS (US) is the North American Human Resources Management System module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP suite built on the Oracle Database and Oracle Application Server/WebLogic middleware. The flaw resides in the Internal Operations subcomponent. Oracle's advisory assigns no CWE (CWE: N/A) and does not disclose the underlying weakness class, but the CVSS profile - local vector, high attack complexity, requiring existing low privileges, with full confidentiality/integrity/availability impact and unchanged scope - is consistent with a privilege-escalation or authorization/logic flaw that an already-authenticated EBS user can abuse to seize control of the HRMS module. Per Oracle's per-product scoring convention, S:U/C:H/I:H/A:H here denotes takeover of Oracle HRMS (US) itself rather than the underlying host OS.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships cumulative CPU bundles rather than a standalone semantic fix version, so apply the CPU patch appropriate to your EBS 12.2.x level and consult the CPU patch matrix for the specific patch number - the input does not provide a discrete fix version, so do not assume one. As compensating controls until patching, restrict and audit who holds application logon accounts on the HRMS/EBS infrastructure (the vector requires PR:L local logon), enforce least-privilege on EBS responsibilities tied to the Internal Operations component, and segment the EBS application tier so only trusted authenticated users can reach it; the trade-off is added friction for legitimate HR administrators and integrations. Because the attack is local and authenticated, network/WAF filtering offers limited protection, making account governance the higher-value control.