EUVD-2026-47441
GHSA-42f9-mm8v-x3vp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network HTTP vector with low-privileged authenticated access aligns with description; no availability impact and partial C/I match the limited payroll data scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (Hong Kong) product of Oracle E-Business Suite (component: Hong Kong Payroll). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Hong Kong). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Hong Kong) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Hong Kong) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Technical ContextAI
Oracle E-Business Suite (EBS) is a large-scale enterprise resource planning platform; Oracle HRMS (Hong Kong) is a localized human-resources and payroll module tailored to Hong Kong statutory requirements. The vulnerability resides in the Hong Kong Payroll component (CPE context: Oracle E-Business Suite versions 12.2.13-12.2.15). The CWE is listed as N/A by NVD, however the vendor tag 'Authentication Bypass' suggests an authorization control flaw - likely a failure to enforce object- or function-level access controls within an authenticated EBS session, a class of issue historically common in Oracle EBS where module-level URL or API endpoints do not re-verify the calling user's role or responsibility entitlements. The HTTP attack vector indicates exploitation targets EBS web-tier endpoints directly.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative patches; organizations should apply the full CPU rather than individual fixes. The exact patched EBS version is not independently confirmed in available data beyond the CPU release - consult My Oracle Support (MOS) Note for the July 2026 CPU for the precise patch number and application instructions. As a compensating control prior to patching, restrict network access to EBS web-tier endpoints hosting the Hong Kong Payroll module to authorized internal IP ranges, reducing the exposed attack surface. Additionally, audit EBS responsibility assignments to ensure only users with legitimate Hong Kong Payroll roles hold access to the affected component, limiting the pool of accounts that could be used for exploitation. Note that restricting network access may affect remote HR staff and requires coordination with business stakeholders.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today