What is the CVSS score of CVE-2026-62560?

CVE-2026-62560 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-62560?

Within 24 hours: audit all Oracle EBS HRMS instances, document affected versions, and inventory systems with low-privilege HRMS credentials. Within 7 days: implement network segmentation to restrict HRMS access to authorized personnel, enforce TLS encryption and certificate validation for HRMS communications, deploy network monitoring for HRMS traffic, and limit low-privilege account access to critical employee data where operationally feasible. Within 30 days: apply the Oracle July 2026 Critical Patch Update when released, or establish a formal upgrade timeline to patched EBS versions.

Oracle E-Business Suite CVE-2026-62560

EUVD-2026-47556 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-8gp2-77pc-xw4x

Authentication Bypass Information Disclosure Oracle Human Resources Management System

7.7

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privilege EBS account
Delivery

Send crafted HTTP request to HRMS (Norway)
Exploit

Bypass authorization on Internal Operations
Execution

Access unauthorized data across scope
Impact

Exfiltrate sensitive HR data

Vulnerability Assessment

Weakness	CWE CWE-200 MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the Oracle E-Business Suite HTTP application tier and a valid low-privileged EBS account (CVSS PR:L), plus the environment must have the Oracle HRMS (Norway) localization module and its Internal Operations component deployed and reachable - i.e. a Norway-specific HRMS deployment. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already be authenticated at some privilege level, the affected version must fall within 12.2.3-12.2.15, and organizations that do not run the Norwegian HRMS localization are not exposed to this specific component.
Impact	The CVSS 3.1 base score is 7.7 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: network-reachable, low attack complexity, only low privileges required, no user interaction, a scope change, and high confidentiality impact with no integrity or availability effect. This is an easily exploitable data-confidentiality issue rather than a code-execution or destructive one. No EPSS score was provided in the input, and there is no CISA KEV listing and no known POC, so there is no evidence of active or imminent widespread exploitation - the priority derives from the low exploitation bar (only a valid low-privilege EBS account is needed) and the scope-change data exposure, not from observed attacks. No SSVC decision data was supplied. The confidentiality-only impact means this should be prioritized where the HRMS (Norway) module holds sensitive personal/HR data, but it is not a remote-unauthenticated or RCE-grade emergency.
Exploit ScenarioDerived	A user holding a low-privilege Oracle EBS account (for example a standard self-service employee login) sends crafted HTTP requests to the HRMS (Norway) Internal Operations functions and, due to the access-control weakness, retrieves HR data they should not be authorized to see, potentially including data belonging to other EBS products via the scope change. No user interaction or elevated privileges are required, and no public POC is currently known.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, with the exact patch level determined by your EBS 12.2.x baseline (the input does not specify a single named fix build, so consult the CPU matrix for your release between 12.2.3 and 12.2.15). Because Oracle mandates CPUs be applied cumulatively, deploy the latest EBS 12.2 patch bundle rather than an isolated hotfix. Until patching, reduce exposure by restricting network access to the EBS HTTP tier and the HRMS (Norway) / Internal Operations functions to trusted networks, and by tightening EBS responsibility and menu grants so low-privileged accounts cannot reach the affected module, while increasing monitoring of HR data access; note these access restrictions may disrupt legitimate self-service or localization workflows and are only compensating controls, not a substitute for the CPU.

Affected VersionsENISA

Oracle HRMS (Norway) 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_hrms_norway no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is a large integrated ERP/HCM platform; the affected component is the Internal Operations piece of the Oracle HRMS (Norway) localization module, reached through the EBS HTTP application tier. Oracle does not assign a CWE for this entry, but the intelligence tags label it an Authentication Bypass, and the CVSS confidentiality-only, scope-changed profile is consistent with an authorization/access-control weakness (CWE-284/CWE-863 class) where an authenticated but low-privileged user can reach data or functionality across trust boundaries. Because EBS modules share a common application and database tier, a flaw in one localization component can expose data owned by other products, which is reflected by the CVSS scope change (S:C).

Know when Human Resources Management System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI 7.7 HIGH

Network-reachable EBS HTTP tier with a low-privilege account (AV:N/PR:L), low complexity, no UI; confidentiality-only data exposure crossing to other products gives S:C, C:H, I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). While the vulnerability is in Oracle HRMS (Norway), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

Oracle E-Business Suite HRMS (versions 12.2.3-12.2.15) contains a high-severity data exposure vulnerability allowing low-privileged remote users to read all HRMS data over HTTP; no public exploit has been identified at time of analysis. Organizations using affected EBS releases face material HR data breach risk, exposing employee records and systems integrated with HRMS to unauthorized access.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Restrict HRMS network access via firewall rules and VPN requirements; enforce mutual TLS with certificate pinning; deploy data loss prevention and user behavior analytics to detect anomalous HRMS queries; establish comprehensive audit logging with automated alerting on sensitive HR data access; consider temporarily revoking or restricting low-privilege accounts' access to critical employee data until patch availability.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

High

widely deployed enterprise ERP suite, though Norway HRMS localization narrows exposure

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.