What is the CVSS score of CVE-2026-62565?

CVE-2026-62565 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle HRMS are affected by CVE-2026-62565?

Oracle E-Business Suite HRMS (versions 12.2.3-12.2.15) contains an authorization bypass that allows low-privileged, network-based users to read sensitive employee payroll and benefits data, and to…

How to fix or mitigate CVE-2026-62565?

Within 24 hours, identify and document all Oracle E-Business Suite instances running HRMS versions 12.2.3-12.2.15, including production and test environments, and assess exposure to low-privilege network users. Within 7 days, establish and communicate a patch deployment timeline using Oracle's July 2026 Critical Patch Update, prioritizing production payroll systems. Within 30 days, complete patch deployment to all affected systems and validate that low-privilege users no longer have unauthorized read/write access to HRMS data.

Oracle HRMS CVE-2026-62565

EUVD-2026-47560 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3rxg-g4hx-g2wm

Authentication Bypass Oracle Human Resources Management System

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L) but needs a low-privileged EBS account (PR:L); high data read (C:H), partial writes (I:L), no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:32 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.

Technical ContextAI

Oracle HRMS (US) is the human-resources and US payroll module of Oracle E-Business Suite (EBS), a large web-based ERP platform typically fronted by Oracle Application Server / HTTP Server and accessed over HTTP. The affected component, US Payroll Year End, handles year-end payroll processing (W-2, tax reporting) and therefore stores highly sensitive PII and compensation data. Oracle does not assign a public CWE for CPU entries (CWE: N/A here); based on the vector (network HTTP, low privilege, high confidentiality/low integrity impact) the flaw class is consistent with broken access control / improper authorization on an EBS servlet or page. The vendor-supplied tag 'Authentication Bypass' is somewhat inconsistent with the CVSS PR:L (requires an existing low-privileged account), and should be treated as an authorization/privilege-escalation weakness rather than a full pre-auth bypass unless Oracle clarifies otherwise.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS security fixes as cumulative CPU patch bundles per 12.2.x release rather than a single named version, so identify and apply the specific patch listed for your installed 12.2.3-12.2.15 level (no standalone fixed version number was provided in the input, so cite the CPU rather than invent one). Until patched, restrict network exposure of the EBS HRMS/US Payroll Year End URLs to trusted internal networks or VPN only, review and tighten EBS responsibility/menu assignments so low-privileged accounts cannot reach payroll year-end functions, and increase monitoring/auditing of HRMS data access; the trade-off is that narrowing responsibilities or blocking URLs may disrupt legitimate year-end payroll workflows and self-service users, so test access changes against payroll operations before enforcing.