Oracle HRMS CVE-2026-62557

Exploitation requires an authenticated low-privilege account on the Oracle E-Business Suite instance (CVSS PR:L) with HTTP network access to the Oracle HRMS (UK) / UK Payroll component, and the affected EBS version must be in the 12.2.3-12.2.15 range. No user interaction is required and attack complexity is low. The key limiting factor is that the attacker must already possess valid (even minimal) EBS credentials plus network reachability to the HRMS web tier - it is not an unauthenticated remote compromise despite the 'Authentication Bypass' tag, so environments that tightly control EBS account provisioning and expose the application only internally materially reduce realistic risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates a network-reachable, low-complexity attack that requires some authentication (PR:L) and no user interaction, yielding high confidentiality loss and limited integrity impact with no availability effect. Oracle rates it 'easily exploitable,' which aligns with AC:L. Weighing all signals: no EPSS score was provided, there is no CISA KEV listing, and no public POC was identified, so real-world exploitation pressure appears lower than the 7.1 score alone might suggest - this reads as a real-but-not-emergency priority. One tension to flag explicitly: the input tag says 'Authentication Bypass' yet the CVSS vector states PR:L (privileges required), so this is more accurately a privilege/authorization escalation available to any low-level authenticated EBS user than an unauthenticated bypass - verify the exact access requirement against Oracle's advisory. Because EBS payroll stores highly sensitive PII and salary data, the confidentiality impact is business-significant even without confirmed active exploitation.

A low-privileged but legitimately authenticated Oracle EBS user (for example, an ordinary self-service employee account) sends crafted HTTP requests to the UK Payroll component and reaches payroll records they are not entitled to, reading salary, tax, and personal data across the organization and altering some records. Because attack complexity is low and no user interaction is needed, a single insider or a phished/compromised low-level account is sufficient; no public exploit code has been identified at time of analysis.