EUVD-2026-47541
GHSA-3m63-63f7-w2pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS HRMS web endpoint over HTTP
-
DeliverySend request to US Payroll page
-
ExploitBypass authentication check
-
ExecutionRead all HRMS-accessible data
-
ImpactExfiltrate payroll and PII records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle E-Business Suite web tier serving the Oracle HRMS (US) US Payroll - General component on a version between 12.2.7 and 12.2.15, reachable over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special client-side conditions are needed against an affected default deployment. The primary limiting factor is exposure: the attacker must be able to route to the HRMS/payroll HTTP endpoints, so installations restricted to internal/VPN networks or without the US Payroll module deployed sharply reduce realistic risk. Version is also a hard limiter - releases outside 12.2.7-12.2.15 are stated as not affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but no integrity or availability effect - a mass data-exposure risk rather than a system-takeover risk. Oracle explicitly calls it 'easily exploitable,' which aligns with AC:L and reinforces real-world reachability if the HRMS/payroll pages are internet- or intranet-exposed. However, no EPSS score, POC, or KEV status was provided in the input, so exploitation probability and active-exploitation signals are unknown; the absence of KEV means there is no confirmation of in-the-wild use. SSVC-style judgment: exploitation is currently 'none' (no evidence), automatable is plausible given no auth and low complexity, and technical impact is partial (confidentiality only). Net: a credible priority for organizations running affected EBS versions with exposed HRMS, but the lack of EPSS/POC data means the urgency is inferred from CVSS and the authentication-bypass tag rather than confirmed exploitation telemetry. |
| Exploit ScenarioDerived | An attacker who can reach the EBS web tier over HTTP - for example an internal user or an internet-facing deployment - sends crafted requests to the US Payroll HRMS endpoints and, exploiting the authentication-bypass condition, retrieves sensitive payroll and HR records (salaries, PII, tax data) without logging in. Because attack complexity is low and no user interaction or credentials are required, the request can be scripted and repeated to bulk-extract all HRMS-accessible data. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update, which is the vendor-released fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fix version string was provided in the input, so consult the CPU matrix for the exact patch level applicable to your 12.2.x installation. Patch available per vendor advisory. As compensating controls until patching, restrict network reachability of the HRMS and payroll endpoints - place EBS behind a VPN or restrict the affected US Payroll pages at the reverse proxy / Oracle HTTP Server so only authenticated internal networks can reach them (trade-off: may break legitimate remote self-service access for employees), and monitor web logs for anomalous unauthenticated requests to HRMS payroll URLs. Because impact is confidentiality-only, prioritize any instance where HRMS is exposed to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Oracle E-Business Suite (EBS), Oracle's flagship on-premise ERP platform, specifically the Human Resource Management System (HRMS) US localization and its US Payroll - General functionality. EBS is a Java/PL-SQL web application typically fronted by Oracle HTTP Server and Oracle WebLogic/Forms, exposing HRMS self-service and payroll pages over HTTP. The vendor's 'Authentication Bypass' tag and the CVSS PR:N metric indicate the payroll data-access path can be reached without a valid session, meaning an authorization/authentication control on a payroll endpoint can be circumvented. The NVD entry lists CWE as N/A, so the precise weakness class (e.g., improper authentication CWE-287 or missing authorization CWE-862) is not formally assigned, but the tag and impact profile point to a broken access-control class of bug.
Know when Human Resources Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network HTTP access with low complexity and no user interaction yields PR:N/AC:L; impact is confidential data disclosure only, so C:H, I:N, A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite HRMS Payroll module (versions 12.2.7-12.2.15) contains an unauthenticated authentication-bypass vulnerability enabling remote attackers to access all HRMS data-including employee compensation, benefits, and personal information-without credentials. Organizations running affected versions face immediate risk of broad employee data exposure with potential regulatory compliance violations and privacy breaches. This vulnerability requires urgent remediation given the authentication bypass mechanism and absence of vendor-released patches.
No vendor-released patch identified at time of analysis. Implement compensating controls: restrict network access to HRMS Payroll modules via firewall segmentation to authorized subnets; enforce HTTPS-only connectivity with mutual TLS where supported; deploy WAF rules to block patterns indicative of unauthenticated data access; enable comprehensive audit logging of all HRMS data queries and exports; monitor for anomalous data-access volume or exfiltration patterns. Escalate patch timeline urgently with Oracle and consider temporary functional isolation of highest-risk payroll data pending remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged rem
Exploit-DB