What is the CVSS score of CVE-2026-62567?

CVE-2026-62567 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle HRMS are affected by CVE-2026-62567?

A data disclosure vulnerability in Oracle E-Business Suite HRMS module (versions 12.2.3-12.2.15) allows authenticated users to access complete payroll and employee datasets.

How to fix or mitigate CVE-2026-62567?

Within 24 hours: identify all Oracle EBS instances running versions 12.2.3-12.2.15 with HRMS UK Payroll enabled; immediately review access logs for unauthorized data access and restrict low-privilege user permissions to payroll and employee data. Within 7 days: obtain and stage the July 2026 Critical Patch Update; conduct testing in non-production environments and deploy to all production systems. Within 30 days: complete deployment across all EBS environments, validate patch effectiveness through security testing, and conduct data access audit to identify any prior unauthorized disclosure.

Oracle HRMS CVE-2026-62567

EUVD-2026-47561 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-v5cg-c985-w5r3

Authentication Bypass Oracle Information Disclosure Human Resources Management System

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP reach with a required low-privilege account (PR:L), no interaction, confidentiality-only impact, and a scope change (S:C) affecting additional products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:31 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle E-Business Suite is Oracle's integrated enterprise application suite; the affected element is the Human Resources Management System (HRMS) UK localization, specifically the UK Payroll component that processes sensitive employee compensation, tax, and personal data. The flaw is exposed through the web (HTTP) tier of EBS and results in confidentiality-only compromise (C:H, I:N, A:N). Oracle assigned no CWE, but the supplier-provided intelligence tags this as an Authentication Bypass; combined with the scope-change flag (S:C), the affected component can be leveraged to access data outside its own security authority. Oracle does not publish detailed root-cause internals for CPU advisories, so the precise mechanism (e.g., access-control or authorization flaw in a payroll servlet/endpoint) is not disclosed.

RemediationAI

Vendor-released patch: apply the Oracle Critical Patch Update of July 2026 (cpujul2026), which contains the fix for CVE-2026-62567 for Oracle E-Business Suite 12.2.3-12.2.15; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers and prerequisites for your release. Because Oracle only supplies fixes via the quarterly CPU and does not publish standalone workarounds here, if immediate patching is not possible, reduce exposure by restricting network reachability of the EBS/HRMS UK Payroll HTTP endpoints to trusted internal networks and VPN users, placing the application behind a reverse proxy or WAF with tightened access-control lists, and reviewing and minimizing user accounts that hold the low-privilege access needed to reach the payroll functionality - noting the trade-off that URL/endpoint restrictions may disrupt legitimate self-service payroll or HR users. Given the scope change, also audit and monitor data access across integrated EBS modules until the CPU is applied.