Oracle HRMS CVE-2026-61123

Exploitation requires a valid low-privileged account within the Oracle E-Business Suite environment (PR:L) with network access to the HRMS application tier via HTTP. The attack complexity is rated High (AC:H), meaning additional conditions beyond attacker control must align - such as specific server-side state, timing, or a race condition within the Internal Operations component. No user interaction is required (UI:N). Limiting factors include: mandatory authentication with at minimum a low-privileged account (no unauthenticated attack path exists), high complexity reducing reliable exploit success, and the partial/limited impact scope (C:L, A:L) even upon successful exploitation. The vulnerability does not enable integrity compromise (I:N). Organizations where HRMS network access is restricted to internal corporate networks or VPN have significantly reduced exposure compared to internet-facing EBS deployments.

The CVSS 3.1 base score of 4.2 (Medium) is derived from a vector of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L. The network attack vector (AV:N) is the most concerning element - the flaw is reachable without local access - but AC:H (high complexity) substantially reduces exploitability by requiring conditions beyond the attacker's direct control, such as race conditions, specific server state, or timing dependencies. PR:L confirms a low-privileged account is necessary, eliminating fully unauthenticated attack paths. Impact is constrained: partial data read (C:L) and partial DoS (A:L) with no integrity impact (I:N). EPSS score was not provided in available data, preventing probability-of-exploitation quantification. No CISA KEV listing exists, and no public proof-of-concept has been identified. Taken together, this is a real but low-urgency vulnerability - the combination of required authentication, high exploitation complexity, and limited impact scope means it is unlikely to be targeted opportunistically. It should be prioritized in the standard patch cycle rather than as an emergency fix.

An attacker with a low-privileged account in the Oracle E-Business Suite environment sends crafted HTTP requests to the Internal Operations endpoint of Oracle HRMS (US). Under high-complexity conditions - such as a specific server state, timing window, or race condition - the attacker successfully reads a subset of sensitive HRMS data (e.g., HR records accessible to their privilege tier) or triggers a partial disruption of the HRMS service. No public exploit code exists at time of analysis, and reliable exploitation requires overcoming AC:H conditions that limit opportunistic attacks.