Oracle HRMS (UK) CVE-2026-61214

Exploitation requires an attacker who is already authenticated to Oracle E-Business Suite with high privileges (PR:H per CVSS vector) and able to reach the application over the network via HTTP. Additionally, the attack complexity is rated High (AC:H), meaning specific, difficult-to-reproduce conditions must be met - likely a particular request structure, timing, or application state within the UK Payroll component. Exploitation is therefore limited to insiders or compromised high-privilege accounts, and is not automatable at scale. What limits exploitation: the requirement for pre-existing high-privilege EBS credentials, high attack complexity, and the narrow data-read impact scope. Default-configuration exploitation by external unauthenticated parties is not possible.

Real-world risk is very low. The CVSS 3.1 base score of 2.2 is driven by three limiting factors: network vector (AV:N) is the only risk amplifier, while high attack complexity (AC:H) and high privilege requirement (PR:H) substantially constrain exploitability. The impact is bounded to partial confidentiality loss (C:L) with no integrity or availability consequences (I:N/A:N). No EPSS score was provided, but given AC:H/PR:H and the absence of any KEV listing or public POC, opportunistic exploitation is implausible. The 'Authentication Bypass' tag appears contradictory with PR:H - this likely describes bypassing a secondary authorization check within an already high-privileged session, not a full credential bypass. EPSS data is absent, which is a gap; however, the CVSS vector, non-KEV status, and no POC all converge on this being a low operational priority except for organizations with UK payroll data sensitivity requirements.

An attacker who already holds a high-privileged Oracle EBS account (such as an HR system administrator) successfully satisfies difficult exploitation conditions - likely a specific request sequence or timing constraint - against the UK Payroll component over HTTP, gaining read access to a subset of HRMS data they would not normally be authorized to view, such as another department's payroll records. No public exploit code exists, making this scenario dependent on attacker-developed tooling and knowledge of the internal access-control flaw.