What is the CVSS score of CVE-2026-61214?

CVE-2026-61214 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle HRMS (UK) CVE-2026-61214

EUVD-2026-47414 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-hrc7-3g8g-rcp7

Information Disclosure Oracle Human Resources Management System

2.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.2 LOW

Vendor vector is well-supported: network HTTP access with high-privilege pre-authentication and high complexity; only partial confidentiality loss, no integrity or availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.

Technical ContextAI

Oracle E-Business Suite (EBS) is an enterprise resource planning (ERP) platform; the HRMS (UK) module extends it with UK-specific human resources and payroll functionality accessed via HTTP. The affected component, UK Payroll, handles sensitive employee compensation and tax data. No CWE identifier was assigned, limiting root-cause classification, but the 'Authentication Bypass' tag suggests an improper authorization or access-control enforcement flaw (broadly aligned with CWE-284 or CWE-862 patterns) within the payroll sub-component - one that an already highly-privileged user can exploit under specific, difficult-to-reproduce conditions to read data outside their intended access scope. Affected CPE encompasses Oracle EBS HRMS (UK) versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html - this is the authoritative remediation source; no exact patched version number beyond the CPU designation is confirmed in available data. Organizations unable to immediately patch should mitigate by restricting high-privilege EBS accounts with access to the UK Payroll component to the minimum necessary personnel, enforcing network-layer access controls (e.g., firewall rules limiting HTTP access to the EBS application tier from trusted subnets only), and auditing session logs for anomalous data access patterns in the UK Payroll module. These compensating controls reduce the already-narrow attack surface but do not eliminate the underlying flaw. The trade-off of delaying patching is a persistent but low-probability data-read exposure limited to users who already hold high privileges.