EUVD-2026-47444
GHSA-7hvm-mqrh-m9vx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible with low complexity; PR:L confirmed by description; no availability impact as only data read and partial data modification are possible.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (New Zealand) product of Oracle E-Business Suite (component: New Zealand Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (New Zealand). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (New Zealand) accessible data as well as unauthorized read access to a subset of Oracle HRMS (New Zealand) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Technical ContextAI
Oracle HRMS (New Zealand) is a localized human resources and payroll management module within Oracle E-Business Suite (EBS), targeting organizations operating under New Zealand payroll regulations. The affected component is specifically New Zealand Payroll, a sub-module handling jurisdiction-specific payroll processing. Affected versions span 12.2.3 through 12.2.15 of the EBS release train. The CWE is listed as N/A by Oracle, but the advisory tag 'Authentication Bypass' suggests the root cause involves insufficient authorization enforcement - an authenticated user with minimal privileges can access or manipulate payroll records beyond their intended permission scope. This is a common pattern in EBS vulnerabilities where function-level or data-level access controls in Oracle Forms or REST endpoints fail to enforce row-level security properly. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates exploitation is straightforward over the network once a low-privileged session is established.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patch version numbers in the advisory summary; organizations should consult My Oracle Support (MOS) for the specific patch ID applicable to their EBS release. If immediate patching is not feasible, consider restricting HTTP access to the New Zealand Payroll component to only those roles and users with a legitimate business need, enforcing IP allowlisting at the network layer to limit exposure of the EBS application tier. Note that Oracle EBS CPU patches are cumulative for the 12.2.x release line, so applying the July 2026 CPU will address this and other concurrently disclosed vulnerabilities. No patch-free workaround has been identified in the available source intelligence.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today