EUVD-2026-47447
GHSA-f67c-58hq-4h4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L reflects mandatory authenticated session; C:L/I:L reflects partial payroll data exposure and modification; A:N as no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Technical ContextAI
Oracle E-Business Suite (EBS) is a large-scale enterprise resource planning platform; Oracle HRMS (UK) is a localized human resources management module tailored for UK legislative and payroll requirements, with the UK Payroll component handling salary, deductions, and statutory pay calculations. The vulnerability is exposed over HTTP, consistent with the web-based EBS application server tier. No CWE identifier was assigned by NVD, limiting formal root-cause classification. However, the 'Authentication Bypass' intelligence tag, cross-referenced against the CVSS PR:L metric (which confirms some authentication is required), strongly suggests this is an authorization bypass rather than a classic authentication bypass - a low-privileged user circumvents access controls to reach data or functions they are not entitled to. No CPE strings were provided in the available intelligence to further narrow the software stack.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number (e.g., a specific 12.2.x patch set) was not independently confirmed in the available intelligence - consult Oracle My Oracle Support and the July 2026 CPU advisory for the applicable EBS patch bundle for your installation. As a compensating control while patching is scheduled, restrict access to the UK Payroll component within EBS to only the roles and users with a legitimate business need, using EBS function security and data security policies. Additionally, implement enhanced audit logging on UK Payroll data access events to detect anomalous read or write activity from low-privilege accounts. Note that network-layer controls alone are insufficient if the attacker already has a valid internal EBS account.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today