What is the CVSS score of CVE-2026-62530?

CVE-2026-62530 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle HRMS are affected by CVE-2026-62530?

Oracle E-Business Suite HRMS (France module) versions 12.2.3-12.2.15 contain a critical data compromise vulnerability (CVSS 8.1) allowing attackers with basic network access to read, create, delete,…

How to fix or mitigate CVE-2026-62530?

Within 24 hours, inventory all Oracle E-Business Suite deployments to identify instances running HRMS versions 12.2.3-12.2.15 and apply network-level restrictions to limit HTTP access to the affected France HR module component. Within 7 days, conduct a privilege audit of database accounts used by HRMS applications, enable audit logging on HR data tables, and evaluate upgrade feasibility to version 12.2.16 or later. Within 30 days, either deploy the vendor patch if released by Oracle or execute a full system upgrade; if neither is available, implement data masking on sensitive HR fields (compensation, employee IDs, personal data) as a temporary control.

Oracle HRMS CVE-2026-62530

EUVD-2026-47546 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w2mf-h36g-4f8h

Authentication Bypass Oracle Human Resources Management System

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP-reachable and low complexity per Oracle; requires an existing low-privileged EBS account so PR:L; data read and manipulation give C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:36 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.

Technical ContextAI

Oracle E-Business Suite is Oracle's integrated ERP/HCM application suite; the affected element is the French HR (HRMS France) localization component handling payroll and human-resources data under French regulatory requirements. Because EBS exposes its modules over HTTP through the Oracle Application Server tier, a network-facing HTTP request path is the exposed surface. Oracle assigned no CWE (CWE: N/A), so the precise weakness class is undocumented; the intelligence tag labels it 'Authentication Bypass,' yet the CVSS vector requires low privileges (PR:L), meaning the attacker must hold some authenticated account rather than being fully anonymous. This tension between the tag and PR:L points to a horizontal/vertical authorization or access-control weakness in the component rather than a true pre-auth bypass.

RemediationAI

Apply the patch delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary vendor-recommended fix, and because Oracle CPU patches are cumulative, applying the latest CPU for EBS 12.2.x resolves this issue. An exact standalone fix version is not independently stated in the provided data, so treat the status as 'Patch available per vendor advisory' and confirm the specific patch/bundle number from the CPU matrix for your EBS release. As compensating controls until patched, restrict HTTP access to the French HR (HRMS France) module and its responsibilities to only required users, tighten EBS responsibility and function security so low-privileged accounts cannot reach French HR pages, and place the application tier behind a reverse proxy or WAF with access limited to trusted networks/VPN; the trade-off is potential disruption to legitimate French HR users and administrative overhead in re-scoping responsibilities. Review HRMS audit logs for anomalous read or modification activity on French HR data.