Oracle HRMS Australia CVE-2026-61251

The attacker must possess a valid Oracle E-Business Suite account at low-privilege level with network access via HTTP to the affected HRMS (Australia) Payroll component - unauthenticated external attackers cannot exploit this flaw directly. The vulnerability is present in all EBS deployments running HRMS Australia Payroll versions 12.2.3 through 12.2.15; no non-default configuration or special feature enablement is indicated as a prerequisite beyond the module being deployed. Exploitation is bounded by the requirement for at least low-level authenticated access, and the unchanged scope (S:U) indicates the vulnerability does not facilitate lateral movement to other system components. The regional specificity of the module (Australia payroll compliance) further limits exposure to organizations that have licensed and deployed this specific EBS module.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a medium-severity vulnerability with high confidentiality impact but no integrity or availability effect. Attack complexity is low and no user interaction is required, making exploitation straightforward for any authenticated low-privileged account. The 'Authentication Bypass' tag creates a mild tension with PR:L - a true authentication bypass would typically carry PR:N; the more defensible interpretation is that an authenticated low-privilege user bypasses authorization controls to access sensitive payroll data beyond their permitted scope. No EPSS score was provided, no POC has been identified, and there is no CISA KEV listing, so active exploitation is unconfirmed. Real-world risk is concentrated among organizations running Oracle EBS with the HRMS Australia module; for those organizations, the high confidentiality impact against payroll data - encompassing salary figures, tax records, and personal employee information - makes this a meaningful remediation priority despite the medium CVSS score. The absence of integrity and availability impact limits blast radius compared to RCE-class flaws.

An attacker holding a low-privileged Oracle EBS account - such as a general HR user, timesheet entry user, or compromised service account - sends crafted HTTP requests to the HRMS (Australia) Payroll component, exploiting the authorization bypass to retrieve payroll records, salary data, or sensitive personal employee information beyond their permitted scope. No public proof-of-concept has been identified, but the low attack complexity, no required user interaction, and purely network-based vector mean a functional exploit could be developed relatively quickly by a motivated actor with authenticated access to an affected EBS instance.