What is the CVSS score of CVE-2026-61123?

CVE-2026-61123 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.2%.

Oracle HRMS CVE-2026-61123

EUVD-2026-47333 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-vfp8-pprm-rj89

Denial Of Service Information Disclosure Oracle Human Resources Management System

4.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

vuln.today AI

4.2 MEDIUM

Vendor-provided vector is internally consistent: network HTTP access (AV:N), authentication required (PR:L), high complexity for exploitation (AC:H), and limited dual-impact with no integrity effect (C:L/I:N/A:L).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:21 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (US) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (US). CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).

AnalysisAI

Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.

Technical ContextAI

Oracle HRMS (US) is the Human Resources Management System module within Oracle E-Business Suite (EBS), a widely deployed enterprise ERP platform serving large organizations primarily in the US. The affected component - Internal Operations - indicates the flaw resides within server-side processing logic exposed over HTTP rather than a client-facing UI. Affected versions span 12.2.3 through 12.2.15, a broad range of the EBS 12.2 Release 2 family. No CWE classification was provided by the reporter (secalert_us@oracle.com), which limits root-cause attribution; however, the CVSS impact profile (C:L, I:N, A:L with AC:H) is consistent with either a logic flaw enabling partial information disclosure under race or state conditions, or a resource exhaustion path exploitable only under constrained circumstances. The HTTP attack vector confirms exposure over standard web interfaces used by EBS application tiers.

RemediationAI

Apply the patch bundle released as part of Oracle Critical Patch Update July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched EBS version number is not independently confirmed from available data - consult the Oracle advisory directly to identify the correct patch set for your installed EBS version (12.2.3-12.2.15). Oracle CPUs are cumulative, so applying the July 2026 CPU addresses this and all prior unpatched vulnerabilities. As a compensating control prior to patching, restrict network access to the EBS Internal Operations HTTP endpoints to only those user accounts and network segments that legitimately require low-privileged HRMS access, reducing the attacker pool and raising the effective barrier; note this does not eliminate the vulnerability but raises practical exploitation difficulty. Disabling the Internal Operations component entirely is likely operationally infeasible in production EBS environments and should not be attempted without Oracle guidance.