What is the CVSS score of CVE-2026-62521?

CVE-2026-62521 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle HRMS are affected by CVE-2026-62521?

Oracle E-Business Suite HRMS Payroll module (versions 12.2.7-12.2.15) contains an unauthenticated authentication-bypass vulnerability enabling remote attackers to access all HRMS data-including…

How to fix or mitigate CVE-2026-62521?

Within 24 hours, identify and inventory all Oracle E-Business Suite instances running versions 12.2.7-12.2.15 with active HRMS Payroll modules; immediately restrict network access to these systems to authorized internal networks only and disable HTTP access. Within 7 days, deploy WAF rules blocking unauthenticated requests to HRMS Payroll endpoints, enable enhanced logging on all HRMS data access, and establish a support case with Oracle to confirm patch-availability timeline and upgrade readiness. Within 30 days, execute migration planning to a patched Oracle E-Business Suite version once vendor patches become available, or evaluate alternative HR platforms if Oracle's patch timeline exceeds organizational risk tolerance; prioritize moving sensitive payroll data processing offline if system isolation is operationally feasible.

Oracle HRMS CVE-2026-62521

EUVD-2026-47541 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3m63-63f7-w2pp

Authentication Bypass Oracle Human Resources Management System

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity and no user interaction yields PR:N/AC:L; impact is confidential data disclosure only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:37 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Oracle E-Business Suite (EBS), Oracle's flagship on-premise ERP platform, specifically the Human Resource Management System (HRMS) US localization and its US Payroll - General functionality. EBS is a Java/PL-SQL web application typically fronted by Oracle HTTP Server and Oracle WebLogic/Forms, exposing HRMS self-service and payroll pages over HTTP. The vendor's 'Authentication Bypass' tag and the CVSS PR:N metric indicate the payroll data-access path can be reached without a valid session, meaning an authorization/authentication control on a payroll endpoint can be circumvented. The NVD entry lists CWE as N/A, so the precise weakness class (e.g., improper authentication CWE-287 or missing authorization CWE-862) is not formally assigned, but the tag and impact profile point to a broken access-control class of bug.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which is the vendor-released fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fix version string was provided in the input, so consult the CPU matrix for the exact patch level applicable to your 12.2.x installation. Patch available per vendor advisory. As compensating controls until patching, restrict network reachability of the HRMS and payroll endpoints - place EBS behind a VPN or restrict the affected US Payroll pages at the reverse proxy / Oracle HTTP Server so only authenticated internal networks can reach them (trade-off: may break legitimate remote self-service access for employees), and monitor web logs for anomalous unauthenticated requests to HRMS payroll URLs. Because impact is confidentiality-only, prioritize any instance where HRMS is exposed to untrusted networks.