What is the CVSS score of CVE-2026-62561?

CVE-2026-62561 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62561?

A vulnerability in Oracle HRMS within E-Business Suite versions 12.2.3-12.2.15 permits authenticated local infrastructure users to fully compromise the HR module, potentially exposing payroll,…

How to fix or mitigate CVE-2026-62561?

Within 24 hours, audit all user accounts with local system access to Oracle E-Business Suite infrastructure and enable detailed logging on HRMS module transactions. Within 7 days, complete a version inventory to identify instances running 12.2.3 through 12.2.15, and implement network segmentation to restrict non-production traffic to HRMS servers. Within 30 days, apply Oracle's July 2026 Critical Patch Update when confirmed released, or execute a documented upgrade path to Oracle E-Business Suite versions 12.2.16 or later where this flaw is remediated.

Oracle E-Business Suite CVE-2026-62561

EUVD-2026-47557 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3xq5-vw38-q48p

Privilege Escalation Oracle Human Resources Management System

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Vendor states local logon and easy exploitation, so AV:L/AC:L/PR:L; module takeover with information disclosure gives full C:H/I:H/A:H, scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:32 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle HRMS (US) is the US-localized Human Resources Management module within Oracle E-Business Suite (EBS), Oracle's large PL/SQL- and Java-based ERP application stack that runs on Oracle Database and Oracle Application Server / WebLogic middleware. The vulnerable Internal Operations component sits inside this application tier, so exploitation requires an authenticated foothold on the infrastructure where EBS executes rather than an anonymous internet request. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper access control, injection, or authorization bypass) cannot be confirmed; Oracle's tag of 'Information Disclosure' aligns with the high confidentiality impact but the full CIA impact indicates the flaw goes beyond disclosure to allow modification and denial of service against the module.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory, with the specific patched build determined by your EBS 12.2.x codelevel (Oracle did not publish a single fixed version number in the source data, so map your 12.2.3-12.2.15 release to the corresponding CPU patch). Because exploitation requires a low-privileged local logon, effective compensating controls until patching include tightening access to the EBS application and database tier hosts (restrict interactive/OS and application accounts to least privilege), auditing and pruning HRMS user accounts and responsibilities, and enforcing network segmentation so only authorized administrators can reach the infrastructure where HRMS executes; the trade-off is added access-management overhead and possible disruption to legitimate integrations that rely on shared or broad accounts. Do not rely on perimeter controls alone, since the attack vector is local.