EUVD-2026-47442
GHSA-7g3x-pg58-76wg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network delivery over HTTPS with no attacker privileges, but mandatory user interaction gates exploitation; impact limited to partial data read and write with no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (Japanese) product of Oracle E-Business Suite (component: Oracle Payroll Japanese). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HRMS (Japanese). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Japanese) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Japanese) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
AnalysisAI
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Technical ContextAI
Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning suite; the Japanese HRMS and Payroll sub-module handles localized HR, payroll calculation, and employee records for Japan-region deployments. The CWE is not formally assigned in the available data, but the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) combined with the 'Authentication Bypass' tag is characteristic of CWE-352 (Cross-Site Request Forgery) or CWE-79 (XSS), where an unauthenticated attacker does not need their own credentials but instead leverages the existing authenticated session of a victim user. Access is over HTTPS, consistent with EBS's standard web-tier deployment via Oracle Application Server or Oracle HTTP Server. Affected CPE covers Oracle EBS 12.2.3 through 12.2.15, all of which share the same Payroll Japanese component codebase.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle E-Business Suite 12.2.x. Oracle does not publish granular fix version strings outside of CPU patch documentation - consult the CPU advisory for exact patch IDs and application instructions. No confirmed specific patched sub-version is independently verifiable from the available data. As a compensating control while patching is in progress, restrict access to the Oracle Payroll Japanese web endpoints to trusted internal networks or VPN, reducing the attack surface for external HTTPS-based CSRF or XSS vectors. Additionally, enforce user security awareness so that HR and payroll personnel do not click unverified external links while authenticated to Oracle EBS. Implementing Content Security Policy (CSP) headers at the Oracle HTTP Server or load-balancer tier can reduce XSS exploitability, though this requires testing against EBS compatibility. Restricting JavaScript execution via browser security policies is a lower-friction interim measure.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today