What is the CVSS score of CVE-2026-62549?

CVE-2026-62549 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62549?

Oracle E-Business Suite HRMS (UK) Payroll component versions 12.2.3-12.2.15 contains a critical vulnerability (CVSS 9.6) allowing low-privileged authenticated users to read, create, delete, and…

How to fix or mitigate CVE-2026-62549?

Within 24 hours, identify all Oracle EBS systems running HRMS versions 12.2.3 through 12.2.15 and restrict network access to these systems where operationally feasible. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected HRMS instances and verify patch installation success across the environment. Within 30 days, conduct a forensic audit of HRMS access logs and data modification records dating back 90 days to identify unauthorized changes, implement enhanced role-based access controls limiting HRMS privileges to essential roles only, and strengthen network segmentation to isolate HRMS from untrusted networks.

Oracle E-Business Suite CVE-2026-62549

EUVD-2026-47552 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cw54-68gf-7r9m

Authentication Bypass Oracle Human Resources Management System

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network HTTP reach with easy exploitation and a low-privileged account (PR:L, AC:L); scope change to other EBS products; high confidentiality/integrity, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:33 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

CRITICAL 9.6

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (UK) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite is a large integrated ERP/HCM web application stack; the affected surface is the Oracle HRMS (UK) module's UK Payroll component, which handles employee, payroll, and compensation records for UK-based deployments. The CWE is not assigned in the input (CWE: N/A), so the precise root cause class is unconfirmed, but the intelligence tag 'Authentication Bypass' combined with the scope-change flag suggests a flaw where an authenticated but low-privileged user can escalate access across trust boundaries within the shared EBS application/database tier. Because EBS modules share a common Oracle database and middle tier, a scope-crossing weakness in one module (HRMS UK Payroll) can expose data owned by other EBS products, which is consistent with the S:C metric. No CPE strings were provided; affected versions are known only from Oracle's version range 12.2.3-12.2.15.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this vulnerability; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapped to your EBS 12.2.x release, as Oracle distributes EBS fixes as cumulative CPU patches rather than a single incremented product version (patch available per vendor advisory; no standalone fix version string is provided in the input). Until the CPU is applied, reduce exposure by restricting network access to the EBS HTTP endpoints and the HRMS/UK Payroll pages to trusted internal networks or VPN only, tightening EBS responsibility/role assignments so low-privileged accounts cannot reach payroll functions, and enabling enhanced auditing on HRMS payroll data access - with the trade-off that URL/responsibility restrictions may block legitimate remote payroll users and increase administrative overhead. Because this is a scope-change vulnerability, prioritize patching even where HRMS UK is considered low-value, since impact can extend to other EBS products.