Oracle HRMS CVE-2026-62556

Exploitation requires the attacker to hold a valid low-privileged account on the Oracle E-Business Suite instance (PR:L per CVSS) - unauthenticated external attackers cannot directly exploit this flaw. The HRMS Internal Operations component must be reachable over HTTP from the attacker's network position (AV:N); in many enterprise deployments, EBS is internal-only, which limits exposure to insider threats or attackers who have already achieved network access. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special timing is needed. Exploitation is limited to read access - no data modification or service disruption is possible through this vector. Only Oracle E-Business Suite versions 12.2.6 through 12.2.15 are listed as affected; deployments running versions outside this range are not confirmed vulnerable per available data.

The CVSS 3.1 base score of 6.5 (Medium) accurately captures the technical severity - confidentiality impact only, no integrity or availability loss - but likely underrepresents business risk. Oracle HRMS stores highly sensitive PII including salary, tax identification, benefits, and employment history, meaning unauthorized read access carries significant regulatory exposure (GDPR, HIPAA in applicable contexts) beyond what the numerical score implies. The PR:L requirement is the primary limiting factor: exploitation is gated on possession of a valid low-privileged EBS account, ruling out fully unauthenticated external exploitation. However, in large enterprise environments EBS typically has hundreds to thousands of active low-privileged user accounts, substantially widening the attacker pool to include malicious insiders and attackers who have already compromised credentials. The 'Authentication Bypass' tag from EUVD creates a minor discrepancy with the CVSS PR:L vector - a true authentication bypass would be PR:N; the more accurate characterization is an authorization bypass (privilege escalation within a session). No EPSS score is available in provided data. No KEV listing and no public POC exist, indicating no confirmed widespread exploitation at time of analysis. Overall this is a genuine medium-priority remediation target elevated to high priority for organizations where HRMS data sensitivity or regulatory requirements are concerns.

An attacker who has obtained or already possesses a low-privileged Oracle E-Business Suite employee self-service account sends crafted HTTP requests targeting the HRMS Internal Operations component, bypassing the application's authorization layer without acquiring additional privileges. The attacker is then able to read all data accessible to the Oracle HRMS (US) application - potentially including salary records, tax IDs, employment histories, and PII for all employees in the system. No public exploit code has been identified, but the low attack complexity (AC:L) means the technique is reproducible with minimal effort once the specific authorization bypass request pattern is identified.