Oracle HRMS Netherlands CVE-2026-71104

Exploitation requires the attacker to hold a high-privilege account within Oracle E-Business Suite (PR:H per the CVSS vector), which is the primary limiting factor. Only organizations that have deployed the Oracle E-Business Suite Netherlands localization module (versions 12.2.3 through 12.2.15) and expose the Netherlands Payroll component over HTTP are within scope. No user interaction is required once valid high-privilege credentials are obtained. The absence of a non-default configuration trigger in Oracle's description suggests the vulnerable code path is reached through standard authenticated payroll operations rather than a specific optional feature. Exploitation is categorically prevented for any attacker lacking high-privilege EBS credentials, distinguishing this from an unauthenticated or low-privilege critical vulnerability.

The CVSS 3.1 score of 7.2 (High) reflects a network-exploitable vulnerability with low complexity and no user interaction, but the PR:H constraint is the critical limiting factor - the attacker must already hold high-privilege credentials within Oracle E-Business Suite. Oracle's advisory describes the vulnerability as 'easily exploitable,' language typically accompanying AC:L/UI:N vectors, yet the privilege prerequisite meaningfully narrows the realistic attacker population to insiders, compromised payroll administrators, or post-breach lateral movers. No EPSS score or CISA KEV listing was available in the provided data, and no public exploit code has been identified, further reducing the likelihood of opportunistic mass exploitation. The full CIA impact (C:H/I:H/A:H) signals that successful exploitation is catastrophic - affecting payroll data integrity, employee records confidentiality, and system availability - meaning even a mid-sized municipal IT team in gliwice running Netherlands-localized EBS should treat this as urgent if high-privilege account hygiene is not tightly controlled. The absence of a disclosed CWE prevents precise technical risk modeling, and the CVSS Scope:Unchanged metric indicates blast radius is contained to the EBS HRMS instance itself.

An attacker who has acquired high-privilege Oracle EBS credentials - through spear-phishing a payroll administrator, credential stuffing from a prior breach, or lateral movement following initial compromise of another EBS-connected system - sends a crafted HTTP request to the Netherlands Payroll component of the target's EBS instance. Because attack complexity is low and no user interaction is required, the attacker achieves full system takeover, enabling exfiltration of sensitive employee payroll records, manipulation of payroll data, or denial of the HRMS service. No public exploit code has been identified at time of analysis.