Oracle HRMS Korea CVE-2026-61254

Exploitation requires an active Oracle EBS session held by a victim user who must interact with attacker-controlled content (e.g., click a link or load a page), consistent with UI:R in the CVSS vector. The vulnerability is accessible over HTTP without attacker-side authentication (PR:N), meaning the attacker does not need valid credentials themselves. Limiting factors include: (1) the vulnerable component is specific to Oracle E-Business Suite deployments with the Korean HRMS/Payroll module licensed and configured - organizations not running this regional module are not affected; (2) the victim must have an active session at the time of the attack; (3) affected versions are bounded to 12.2.3-12.2.15, so organizations outside this release range are not exposed. No default-configuration language is used in the description - deployment of the Korean Payroll module constitutes the required condition.

CVSS 3.1 rates this 5.4 (Medium), with network attack vector, low complexity, no required privileges, but mandatory user interaction (UI:R). The limited confidentiality and integrity impacts (both C:L, I:L) and absence of availability impact cap the score. Real-world risk is further modulated by the narrow deployment footprint - this component is specific to Korean payroll operations within Oracle EBS, substantially reducing the universe of exposed systems. No EPSS data was provided and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The 'Authentication Bypass' tag is notable: even with PR:N, if attackers can bypass access controls to reach payroll data, the business sensitivity of that data (payroll records, compensation, employee PII) elevates the practical impact beyond what the CVSS score alone conveys. CVSS signals low-to-medium technical severity; business context in regulated payroll environments elevates triage priority for affected Korean EBS deployments.

An attacker crafts a malicious HTTP request or page targeting the Korean Payroll component and socially engineers a victim who has an active Oracle EBS session to visit the link or load the page. The victim's browser executes the cross-site request, bypassing access controls and causing the application to read or modify payroll records on the attacker's behalf. No public proof-of-concept code has been identified, so exploitation currently requires attacker skill in constructing the request payload against the Oracle EBS Korean Payroll interface.