What is the CVSS score of CVE-2026-62556?

CVE-2026-62556 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle HRMS CVE-2026-62556

EUVD-2026-47553 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mjwv-5fmg-f43q

Authentication Bypass Information Disclosure Oracle Human Resources Management System

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP access with low complexity confirmed; PR:L reflects required authenticated EBS account; confidentiality-only as no modification or disruption is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's flagship enterprise resource planning platform, and Oracle HRMS (US) is its Human Resources Management System module covering payroll, workforce, and employee lifecycle data. The affected component is 'Internal Operations,' an internal service layer within HRMS accessible over HTTP. Although no CWE is formally assigned, the EUVD intelligence tag 'Authentication Bypass' indicates the root cause is likely an improper authorization control - a low-privileged user can issue crafted HTTP requests that bypass the application's role-based access checks within Internal Operations, escalating their effective data access without acquiring elevated privileges. Affected product scope per vendor advisory covers EBS versions 12.2.6 through 12.2.15 (EUVD-2026-47553). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is fully consistent with an authorization bypass yielding read-only data exposure scoped to the HRMS application boundary.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability across Oracle E-Business Suite versions 12.2.6 through 12.2.15. The advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html; consult Oracle My Oracle Support (MOS) for the specific patch ID and incremental patch instructions, as an exact patched release version number is not independently confirmed in available public references. If immediate patching is not feasible, restrict network-level access to the Oracle HRMS Internal Operations HTTP endpoint to only those IP ranges and user populations that legitimately require it, using firewall or Oracle EBS function security controls - note that overly broad restrictions may disrupt HR workflows and should be validated in a non-production environment first. Additionally, audit and minimize the pool of active low-privileged EBS accounts, revoking unused or stale accounts to reduce the potential attacker footprint. Oracle CPU patches are cumulative for EBS; confirm patch prerequisites and conflicts with Oracle Support before applying.