Oracle HRMS CVE-2026-61255

Exploitation requires a valid, low-privileged authenticated session on the Oracle E-Business Suite instance hosting the New Zealand Payroll component - specifically HRMS (New Zealand) versions 12.2.3 through 12.2.15. The attacker must have network access to the EBS application tier via HTTP. No special configuration beyond a running New Zealand Payroll deployment is implied; however, exploitation is inherently limited to organizations that have licensed and deployed the New Zealand-localized HRMS module. Limiting factors include: required authenticated access (PR:L per CVSS - unauthenticated exploitation is not supported by the data), geographic/regulatory niche of the affected module, and the unchanged scope (S:U) indicating no lateral movement to other EBS components. The specific nature of the authorization bypass - whether it affects Oracle Forms, REST APIs, or concurrent program submissions - is not disclosed by Oracle.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible vulnerability with low attack complexity and low privilege requirements, resulting in partial confidentiality and integrity impacts with no availability loss. The PR:L metric confirms that at least one valid account is needed, which moderates the attack surface compared to unauthenticated flaws. The 'Authentication Bypass' tag is notable - it implies that the authenticated session is leveraged to circumvent authorization controls rather than requiring credentials for initial access. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC is known, suggesting opportunistic exploitation is not currently widespread. Real-world risk is concentrated in organizations running New Zealand payroll on Oracle EBS - a geographically and functionally narrow population. Despite the moderate CVSS score, payroll data sensitivity (employee compensation, tax identifiers, bank account details) elevates the business impact of even partial read/write access beyond what the numeric score conveys. This should be treated as a priority patch for any NZ EBS deployment, but does not represent broad sector-wide risk.

An attacker with a low-privileged Oracle EBS account - such as a general HR self-service user or a contractor account - sends crafted HTTP requests to the New Zealand Payroll component, exploiting insufficient authorization checks to access payroll records outside their assigned data scope. This could allow the attacker to read salary or tax data for other employees or modify payroll entries, potentially altering payment amounts or bank account details. No public exploit code is known, but the low complexity rating suggests exploitation would be straightforward for an insider or compromised low-privilege account.