What is the CVSS score of CVE-2026-62560?

CVE-2026-62560 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62560?

Oracle E-Business Suite HRMS (versions 12.2.3-12.2.15) contains a high-severity data exposure vulnerability allowing low-privileged remote users to read all HRMS data over HTTP; no public exploit has…

How to fix or mitigate CVE-2026-62560?

Within 24 hours: audit all Oracle EBS HRMS instances, document affected versions, and inventory systems with low-privilege HRMS credentials. Within 7 days: implement network segmentation to restrict HRMS access to authorized personnel, enforce TLS encryption and certificate validation for HRMS communications, deploy network monitoring for HRMS traffic, and limit low-privilege account access to critical employee data where operationally feasible. Within 30 days: apply the Oracle July 2026 Critical Patch Update when released, or establish a formal upgrade timeline to patched EBS versions.

Oracle E-Business Suite CVE-2026-62560

EUVD-2026-47556 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-8gp2-77pc-xw4x

Authentication Bypass Information Disclosure Oracle Human Resources Management System

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable EBS HTTP tier with a low-privilege account (AV:N/PR:L), low complexity, no UI; confidentiality-only data exposure crossing to other products gives S:C, C:H, I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:33 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). While the vulnerability is in Oracle HRMS (Norway), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.

Technical ContextAI

Oracle E-Business Suite is a large integrated ERP/HCM platform; the affected component is the Internal Operations piece of the Oracle HRMS (Norway) localization module, reached through the EBS HTTP application tier. Oracle does not assign a CWE for this entry, but the intelligence tags label it an Authentication Bypass, and the CVSS confidentiality-only, scope-changed profile is consistent with an authorization/access-control weakness (CWE-284/CWE-863 class) where an authenticated but low-privileged user can reach data or functionality across trust boundaries. Because EBS modules share a common application and database tier, a flaw in one localization component can expose data owned by other products, which is reflected by the CVSS scope change (S:C).

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, with the exact patch level determined by your EBS 12.2.x baseline (the input does not specify a single named fix build, so consult the CPU matrix for your release between 12.2.3 and 12.2.15). Because Oracle mandates CPUs be applied cumulatively, deploy the latest EBS 12.2 patch bundle rather than an isolated hotfix. Until patching, reduce exposure by restricting network access to the EBS HTTP tier and the HRMS (Norway) / Internal Operations functions to trusted networks, and by tightening EBS responsibility and menu grants so low-privileged accounts cannot reach the affected module, while increasing monitoring of HR data access; note these access restrictions may disrupt legitimate self-service or localization workflows and are only compensating controls, not a substitute for the CPU.