Oracle HRMS (US) CVE-2026-62559

Exploitation requires: (1) the attacker holds or has compromised a high-privileged Oracle HRMS (US) account (confirmed by PR:H in the CVSS vector); (2) Oracle E-Business Suite version 12.2.3 through 12.2.15 must be running; and (3) the Internal Operations component must be reachable over the network via HTTP. The scope change (S:C) means successful exploitation can also impact other Oracle EBS products deployed in the same environment. The primary limiting factor is the PR:H prerequisite - unauthenticated users and low-privilege accounts are not expected to directly trigger this vulnerability under the stated CVSS assessment. However, the intelligence feed tags this as 'Authentication Bypass,' which conflicts with PR:H; if this tag is accurate, the effective privilege bar could be lower than CVSS indicates, and this inconsistency must be verified from Oracle's full CPU advisory text. No non-default configuration flags or feature enablement conditions are cited as prerequisites in the available description.

The CVSS 3.1 base score of 6.8 sits in the medium band, constrained primarily by the high-privileges prerequisite (PR:H) that reduces exploitability despite the low-complexity network attack vector. Real-world risk is moderate-to-elevated for affected enterprises: exploitation requires an attacker who already holds or has compromised a high-privileged Oracle EBS account - a non-trivial bar - but the scope change (S:C) and complete confidentiality impact (C:H) mean a single privileged account compromise can result in exfiltration of sensitive HR records, payroll data, and benefits information across multiple EBS modules. The 'Authentication Bypass' tag introduces a meaningful uncertainty: if the bypass allows a lower-privilege account to escalate or reach this component, the actual exploitation bar may be lower than PR:H implies - this conflict must be verified against Oracle's full CPU advisory text before finalizing risk posture. No CISA KEV listing confirms active exploitation. No EPSS score was provided in the feed. No public proof-of-concept code has been identified, suggesting this is not being exploited at scale. This is a real priority for organizations with internet-exposed Oracle EBS deployments or elevated insider-threat profiles, particularly given the sensitivity of HR data in scope.

An attacker who holds or has compromised a high-privileged Oracle HRMS administrator account sends crafted HTTP requests to the Internal Operations component, exploiting an authorization bypass flaw to read sensitive HR data - including employee records, payroll figures, and benefits details - and through the scope change, accesses data within additional co-deployed Oracle E-Business Suite modules beyond the attacker's normal authorization boundary. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity designation indicates a knowledgeable insider or an attacker with a prior foothold and privileged credentials could develop an exploit with moderate effort.