What is the CVSS score of CVE-2026-62557?

CVE-2026-62557 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle HRMS are affected by CVE-2026-62557?

Oracle HRMS UK Payroll within E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability allowing low-privileged attackers to read all HRMS-accessible data, including sensitive payroll and…

How to fix or mitigate CVE-2026-62557?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and audit HRMS access logs for unauthorized data access. Within 7 days, implement network-level access controls to restrict HTTP access to Oracle E-Business Suite HRMS modules to authorized users only, enforce multi-factor authentication for HRMS access, and conduct a comprehensive audit of HRMS data access. Within 30 days, contact Oracle support for patch availability updates and develop an upgrade roadmap to migrate systems beyond affected versions.

Oracle HRMS CVE-2026-62557

EUVD-2026-47554 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m38w-9fjf-cg7p

Authentication Bypass Oracle Human Resources Management System

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP access with low complexity but a valid low-privilege EBS account (PR:L); high confidentiality and low integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:34 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.

Technical ContextAI

Oracle HRMS (UK) is the human-resources and UK-specific payroll module of Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform. The affected UK Payroll component runs within the EBS application tier and is reached over HTTP through the EBS web front end, which fronts an Oracle Database backend. Oracle did not assign a CWE (listed N/A), so the precise root-cause class is unconfirmed; the supplied 'Authentication Bypass' tag combined with the CVSS PR:L requirement points to a broken access-control / authorization weakness where an already-authenticated low-privilege user can reach payroll data and functions beyond their intended entitlement, rather than a fully unauthenticated bypass. No CPE strings were provided, so the exact affected configurations rely on Oracle's version list of 12.2.3 to 12.2.15.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which contains the fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch and version applicable to your EBS 12.2.x installation, as no standalone fix version was published in the input beyond the CPU itself (Patch available per vendor advisory). Until the CPU is applied, reduce exposure by restricting network reachability of the EBS/HRMS web tier to trusted internal networks or VPN rather than the public internet, tightening role and responsibility assignments so low-privilege accounts cannot reach UK Payroll functions, and increasing auditing of payroll data access - note that restricting responsibilities may disrupt legitimate HR users and is only a stopgap, not a substitute for patching. Do not rely on network filtering alone, because the attack requires only an authenticated low-privilege session.