Oracle HRMS CVE-2026-61120

Exploitation requires an authenticated low-privileged logon (PR:L) to the infrastructure where Oracle HRMS (US) executes and local access (AV:L); it is not remotely exploitable by an anonymous internet attacker. The target must be Oracle E-Business Suite running Oracle HRMS (US) at version 12.2.3 through 12.2.15 with the Internal Operations component in use. Limiting factors that reduce real-world risk: the attacker must already hold valid credentials on the system, no exploit is public, and Oracle explicitly rates this 'difficult to exploit' (AC:H), meaning success depends on conditions the attacker cannot fully control such as timing, state, or specific configuration. No victim user interaction is required (UI:N).

The signals point to a real but constrained risk. The CVSS vector (AV:L, AC:H, PR:L, UI:N) requires the attacker to already hold a valid low-privileged logon to the infrastructure where HRMS runs and to overcome high attack complexity, which meaningfully lowers the likelihood of opportunistic or mass exploitation. No EPSS score, SSVC decision, or CWE was provided, so automatable/exploitation potential cannot be quantified from the input. It is not in CISA KEV and no POC is referenced, so this is not a drop-everything emergency; however, C:H/I:H/A:H means that once conditions are met the consequence is total compromise of a module holding sensitive HR and payroll data. Note a conflict worth flagging: the input tag 'Information Disclosure' understates the vector's full I:H/A:H impact - trust the CVSS impact metrics over the tag. Net assessment: a patch-in-normal-cycle priority, escalated where the population of users holding EBS logon is large or untrusted.

An attacker who already possesses a low-privileged Oracle EBS logon - for example a routine employee self-service account or a compromised internal credential - crafts the specific sequence of interactions against the HRMS Internal Operations component needed to trigger the flaw. Overcoming the high attack complexity, they escalate from limited access to full control of the HRMS (US) module, exposing and altering HR and payroll records. No public exploit code is currently known, so this requires attacker-developed tradecraft.