What is the CVSS score of CVE-2026-62456?

CVE-2026-62456 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle HRMS are affected by CVE-2026-62456?

A high-severity vulnerability in Oracle HRMS (UK) module within Oracle E-Business Suite exposes critical HR data to unauthorized access, modification, and deletion by authenticated network attackers.

How to fix or mitigate CVE-2026-62456?

Within 24 hours: Identify all systems running Oracle E-Business Suite with the HRMS module enabled; review authentication logs and database access logs for suspicious activity targeting HR tables; assess network connectivity to vulnerable instances. Within 7 days: Implement network segmentation to restrict HRMS database access to authorized administrative subnets; enable database activity monitoring and alerting for HR data modifications; enforce multi-factor authentication for all HRMS user accounts; contact Oracle support to confirm patch availability and supported remediation paths. Within 30 days: Deploy any vendor-released patches immediately upon availability; if no patch forthcoming, plan a phased upgrade to a patched version of Oracle E-Business Suite; document all interim compensating controls and schedule quarterly reviews until permanent fix is deployed.

Oracle HRMS CVE-2026-62456

EUVD-2026-47501 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-pxxm-mr23-3x3v

Authentication Bypass Oracle Privilege Escalation Human Resources Management System

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

HTTPS network vector (AV:N), vendor-stated difficult exploitation (AC:H), requires a low-privilege account (PR:L), scope change to other products (S:C), high confidentiality/integrity but no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:47 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (UK) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.

Technical ContextAI

Oracle E-Business Suite is a large, web-based enterprise ERP/HCM platform; the affected piece is the Oracle HRMS (UK) localization module served over HTTPS through the Internal Operations component. The scope-change flag (S:C) means the vulnerable HRMS component can be leveraged to affect resources managed by other EBS components under a different security authority, which fits EBS's shared application-tier and database privilege model. No CWE was assigned by NVD; the vendor tag 'Authentication Bypass' hints at a trust/authorization boundary weakness, but this is not corroborated by the CVSS vector, which still requires low privileges (PR:L), so the root-cause class cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not include a discrete fix build number, so this is 'Patch available per vendor advisory' and the exact patch level should be taken directly from the CPU matrix for your EBS 12.2.x release. As compensating controls until patching, restrict network reachability of the EBS application tier and the HRMS/Internal Operations URLs to trusted internal networks or VPN only (trade-off: may break legitimate remote self-service HR access), tighten and review the low-privilege application accounts and HRMS responsibilities/roles that could reach the component and remove unneeded grants (trade-off: possible workflow disruption for HR staff), and enable enhanced logging/monitoring on HRMS transactions to detect anomalous create/delete/modify activity. Because the vulnerability carries a scope change, also review cross-component privilege grants so a compromise of HRMS cannot cascade to other EBS products.