EUVD-2026-47440
GHSA-cqrw-c3vx-vwjq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible HTTP endpoint requires low-privileged authentication; only confidential payroll data exposed with no integrity or availability impact and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the HRMS (Australia) product of Oracle E-Business Suite (component: Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise HRMS (Australia). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all HRMS (Australia) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Technical ContextAI
Oracle E-Business Suite (EBS) is a comprehensive enterprise ERP platform, and HRMS (Australia) is a regional human resources management module within it, providing payroll processing tailored to Australian regulatory requirements. The vulnerability resides in the Payroll sub-component across versions 12.2.3-12.2.15 and is tagged 'Authentication Bypass,' suggesting insufficient authorization enforcement - a low-privileged authenticated user can access resources or data ordinarily restricted to higher-privileged roles. No CWE was formally assigned, but the behavior is consistent with broken access control or insecure direct object reference patterns (CWE-284 or CWE-639 class) in Oracle EBS web application tiers. The attack surface is HTTP-based, reflecting the standard web delivery model of Oracle EBS Payroll self-service and administrative interfaces. No CPE string was supplied in the source data.
RemediationAI
Apply the Oracle Critical Patch Update released in July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not specified in the available references and must be obtained directly from Oracle's CPU documentation or My Oracle Support for the applicable EBS 12.2.x release. As a compensating control pending patch application, restrict HTTP access to the HRMS Australia Payroll component to only those network segments and authenticated roles that operationally require it using Oracle EBS function security and menu exclusions - this reduces the pool of accounts that can reach the vulnerable endpoint. Additionally, audit current low-privileged role assignments in Oracle EBS to identify accounts with unnecessary access to the Payroll module. Note that network-layer restrictions reduce attack surface but do not remediate the underlying authorization bypass, and role auditing may be disruptive if role assignments are broadly applied.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today