What is the CVSS score of CVE-2026-61121?

CVE-2026-61121 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Human Resources Management System are affected by CVE-2026-61121?

Oracle HRMS (UK) Payroll in E-Business Suite versions 12.2.8-12.2.15 contains a critical vulnerability allowing low-privileged network users to fully compromise the payroll module, exposing employee…

How to fix or mitigate CVE-2026-61121?

Within 24 hours: inventory all systems running Oracle E-Business Suite 12.2.8 through 12.2.15 and confirm HRMS UK Payroll module deployment; map network accessibility and document current access controls. Within 7 days: implement network segmentation to restrict HTTP access to the module to authorized users only, enable IP whitelisting for module access, review and remove excessive low-privilege user access, and activate enhanced logging for HRMS authentication and privilege events. Within 30 days: monitor Oracle Critical Patch Update announcements; test patched versions in non-production environment; deploy fixes to all affected systems as soon as vendor releases patched versions of E-Business Suite.

Human Resources Management System CVE-2026-61121

EUVD-2026-47331 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-568h-v6gc-f79w

Privilege Escalation Oracle Human Resources Management System

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (UK). CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.