EUVD-2026-62047
GHSA-cv57-8xpp-75xq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
PR:H reflects mandatory high-privilege credential prerequisite; full CIA impact consistent with Oracle-described system takeover; scope unchanged as blast radius stays within EBS instance.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle HRMS (Netherlands) product of Oracle E-Business Suite (component: Netherlands Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Netherlands). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (Netherlands). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a high-privilege account within Oracle E-Business Suite (PR:H per the CVSS vector), which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 (High) reflects a network-exploitable vulnerability with low complexity and no user interaction, but the PR:H constraint is the critical limiting factor - the attacker must already hold high-privilege credentials within Oracle E-Business Suite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update for August 2026 by following the guidance published at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses CVE-2026-71104 across E-Business Suite versions 12.2.3 through 12.2.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Oracle HRMS deployments to identify instances of versions 12.2.3-12.2.15 with the Netherlands Payroll module enabled and determine network accessibility from the internet or untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today