What is the CVSS score of CVE-2026-61267?

CVE-2026-61267 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of HCM Configuration Workbench are affected by CVE-2026-61267?

A remote unauthenticated vulnerability in Oracle HCM Configuration Workbench affects EBS releases 12.2.3 through 12.2.15, allowing attackers to manipulate, delete, or read critical human resources…

How to fix or mitigate CVE-2026-61267?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and document their network exposure; prioritize systems accessible from the internet or untrusted networks. Within 7 days, implement network-layer mitigations: restrict HTTP access to the HCM Configuration Workbench to authorized internal IP ranges via firewall or WAF rules, and disable the Spreadsheet Loading component entirely if not operationally required. Within 30 days, establish continuous monitoring of vendor security advisories for CVE-2026-61267, test any available patches in a non-production environment, and develop a deployment plan for immediate application once vendor-released patches become available.

HCM Configuration Workbench CVE-2026-61267

EUVD-2026-47453 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-v5g7-v8xc-p225

Denial Of Service Information Disclosure Oracle Human Capital Management Configuration Workbench

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Unauthenticated HTTP-reachable endpoint gives AV:N/AC:L/PR:N/UI:N; access is limited to a data subset and partial DoS, so C/I/A are each Low with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:02 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HCM Configuration Workbench accessible data as well as unauthorized read access to a subset of Oracle HCM Configuration Workbench accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Configuration Workbench. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data manipulation in Oracle HCM Configuration Workbench (part of Oracle E-Business Suite, Spreadsheet Loading component) lets a remote unauthenticated attacker reach the application over HTTP and perform unauthorized update, insert, delete and limited read operations, plus trigger a partial denial of service. All EBS releases from 12.2.3 through 12.2.15 are affected. Rated CVSS 3.1 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication network reach makes it a meaningful patch priority for exposed EBS deployments.

Technical ContextAI

Oracle E-Business Suite is Oracle's on-premises ERP application stack; HCM Configuration Workbench is the human-capital-management setup/administration module, and the vulnerable surface is its Spreadsheet Loading component, which ingests spreadsheet-formatted data through the EBS web tier over HTTP. Because the flaw is reachable pre-authentication, the weakness most likely lies in an unauthenticated or improperly access-controlled request handler in the spreadsheet upload/processing path that fails to enforce authorization before performing database writes and reads. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class (e.g., missing authentication, improper access control, or injection) cannot be confirmed from the supplied data; the low C/I/A impact sub-scores indicate the affected operations touch only a subset of module-accessible data rather than the full EBS schema.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though the source data does not include a discrete fix build number, so identify the exact patch for your EBS 12.2.x level from the CPU matrix and apply it. Because exploitation is unauthenticated over HTTP, the highest-value compensating control until patching is to remove internet exposure of the EBS web tier and restrict access to the HCM Configuration Workbench / Spreadsheet Loading endpoints - for example via URL firewall/reverse-proxy allowlisting (Oracle EBS supports a URL firewall configuration) to block external reach to the affected module, at the cost of denying legitimate remote administrative use. Where the Spreadsheet Loading feature is not operationally required, disabling or tightly access-controlling it reduces the attack surface, with the trade-off of losing spreadsheet-based configuration loading.