What is the CVSS score of CVE-2026-62465?

CVE-2026-62465 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Oracle HRMS (US) CVE-2026-62465

EUVD-2026-47503 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fj37-2jc7-8p2g

Authentication Bypass Oracle Human Resources Management System

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

6.6 MEDIUM

Local exploitation requiring authenticated low-privilege logon to host; no network path; A:H reflects repeatable crash; C:L and I:L reflect partial, bounded data impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:16 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HRMS (US) as well as unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data and unauthorized read access to a subset of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).

AnalysisAI

Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle HRMS (US) is the U.S.-localized Human Resources Management System module within Oracle E-Business Suite (EBS), a large-scale enterprise application platform widely used for HR, payroll, and workforce management. The affected subcomponent is identified as 'Internal Operations,' which suggests the flaw resides in back-end processing logic rather than a user-facing interface. No CWE classification was provided, which prevents precise root-cause characterization - possible classes include improper resource management, access control bypass, or input validation failure within internal process handling. The local attack vector (AV:L) confirms the vulnerability is exercised from the same host where the HRMS process runs, indicating it is not reachable via standard network interfaces. Affected versions span EBS 12.2.9 through 12.2.15 per Oracle's July 2026 CPU advisory and confirmed by EUVD-2026-47503.

RemediationAI

Oracle has released a fix for this vulnerability as part of the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. Organizations running Oracle E-Business Suite versions 12.2.9 through 12.2.15 with the HRMS (US) module should apply the relevant CPU patches according to Oracle's patch application instructions; the exact patched release version should be confirmed from Oracle's official patch catalog, as the advisory does not specify a standalone patch version in the available source data. If immediate patching is not feasible, compensating controls should target the local access prerequisite: restrict OS-level user accounts with logon rights to HRMS host systems, audit and tighten Oracle EBS application-level user grants on the Internal Operations component, and enforce the principle of least privilege for service and batch accounts. Note that access restriction mitigates the attack surface but does not eliminate the underlying flaw. Organizations should also implement process crash alerting on the HRMS service to detect exploitation attempts while patching is in progress.