Oracle HRMS Hong Kong CVE-2026-61252

Exploitation requires an active, authenticated Oracle E-Business Suite user account with at minimum low-privileged access (PR:L per CVSS vector) - unauthenticated exploitation is not supported by available data. The vulnerability is specific to deployments where the Hong Kong Payroll localization module is installed and active within EBS versions 12.2.13 through 12.2.15; organizations running EBS without this localization module, or on versions outside this range, are not affected. The attack is conducted over HTTP (network-accessible, no local system access required) with no user interaction needed beyond the attacker's own session. Exploitation is limited by the requirement for valid EBS credentials and the partial data impact scope - attackers can only reach data accessible to the Hong Kong Payroll component, not the full EBS database.

The official CVSS 3.1 Base Score of 5.4 (Medium) reflects a genuinely moderate risk profile: network-accessible (AV:N), low complexity (AC:L), but requires existing low-privileged credentials (PR:L), with limited confidentiality and integrity impacts and no availability impact. EPSS data is not provided in available sources, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept has been identified, suggesting no active or widespread exploitation at time of analysis. The vendor-applied tag 'Authentication Bypass' introduces a minor inconsistency: a true authentication bypass would typically carry PR:N, whereas the CVSS vector specifies PR:L - this is most likely an authorization bypass within an authenticated session rather than a full authentication circumvention, and defenders should verify the exact mechanism with Oracle's advisory. Real-world priority is moderate for organizations with multi-region EBS deployments processing Hong Kong payroll data, given the sensitivity of payroll records (compensation, tax, banking details) even when impact is rated 'partial' by CVSS.

An attacker with a valid low-privileged EBS account - such as a regular employee with self-service access, or a compromised service account - authenticates to the Oracle E-Business Suite web interface and sends crafted HTTP requests targeting Hong Kong Payroll module endpoints that fail to enforce proper authorization checks. The attacker reads payroll data belonging to other employees (compensation figures, bank account details, tax records) and may insert or modify payroll records, potentially redirecting salary payments or tampering with tax filings. No public proof-of-concept has been identified, but the low attack complexity and standard HTTP vector mean any authenticated user familiar with EBS URL structures could feasibly attempt this without specialized tooling.