EUVD-2026-47555
GHSA-8vgv-9xq5-mrwc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H confirmed by description requiring high-privileged attacker; S:C reflects cross-module EBS impact; C:H only as no integrity or availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). While the vulnerability is in Oracle HRMS (US), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Technical ContextAI
Oracle HRMS (US) is the US-localized human resources management module within Oracle E-Business Suite (EBS), a large-scale enterprise application platform used for finance, HR, and supply chain operations. The vulnerable component is Internal Operations, present in EBS versions 12.2.3 through 12.2.15. The CVSS vector AV:N/AC:L/PR:H/UI:N reflects network-accessible exploitation over HTTP with low attack complexity and no user interaction once the attacker holds a high-privileged session. The Scope:Changed (S:C) metric is particularly significant - it indicates the vulnerability breaks the security boundary of the HRMS module, allowing impact to propagate into adjacent Oracle EBS products sharing the same deployment. No CWE was assigned by NVD, preventing authoritative root-cause classification; however, the intelligence feed tag 'Authentication Bypass' suggests the flaw involves improper enforcement of authentication or authorization controls within the Internal Operations component. This tag, combined with the scope change, may indicate a high-privileged HRMS user can bypass access controls in downstream EBS components, rather than implying full unauthenticated access. No CPE strings were provided in the feed.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, which addresses CVE-2026-62559 in Oracle HRMS (US) versions 12.2.3 through 12.2.15; the full advisory is at https://www.oracle.com/security-alerts/cpujul2026.html. The specific patched version identifier was not confirmed in the available intelligence data and must be verified directly in Oracle's CPU patch notes before deployment. If immediate patching is not feasible, restrict network access to Oracle EBS Internal Operations endpoints using perimeter firewall rules or Oracle EBS servlet/application-level access controls to limit reachability to known trusted internal hosts only, accepting the trade-off that this does not eliminate insider-threat risk. Additionally, audit and reduce high-privileged Oracle HRMS user accounts to the minimum necessary, revoking unnecessary elevated roles to narrow the set of accounts capable of triggering this flaw. Enable and actively monitor Oracle EBS audit trails for anomalous cross-module data access, particularly in the HR and Internal Operations components, as a detective control during the patching window.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today