Oracle HRMS UK EUVD-2026-47447

Exploitation requires a valid, authenticated Oracle E-Business Suite account with at minimum low-privilege access (PR:L per the vendor CVSS vector) and network connectivity to the EBS application server over HTTP. The vulnerable component is specifically the UK Payroll function within Oracle HRMS (UK) - deployments that do not use this UK-localized module are not affected. No user interaction by a third party is required once the attacker has an authenticated session. Exploitation is bounded by the authentication prerequisite: unauthenticated external attackers cannot exploit this directly. The 'Authentication Bypass' tag indicates the bypass occurs within the application's authorization layer, allowing a legitimately authenticated user to reach data or operations beyond their assigned role permissions. Scope is unchanged (S:U), meaning exploitation cannot pivot to other EBS components or the underlying OS through this flaw alone.

The vendor-assigned CVSS 3.1 score of 5.4 (Medium) reflects a moderate but bounded risk profile: the attack is network-reachable with low complexity (AC:L) and requires only low-privilege authentication (PR:L), but impact is constrained to partial confidentiality (C:L) and integrity (I:L) with no availability impact (A:N). The 'Authentication Bypass' tag creates a notable interpretive tension - the CVSS PR:L metric confirms that some form of authentication is prerequisite, indicating the bypass operates at the authorization layer (what authenticated users are permitted to do) rather than eliminating the need for credentials entirely. EPSS data was not available in the provided intelligence, precluding probabilistic exploitation estimates. Neither active exploitation (CISA KEV) nor public proof-of-concept code has been identified. The realistic priority is moderate: payroll data is sensitive HR and financial information, and unauthorized modification could result in fraudulent pay records, but the attack surface is limited to authenticated EBS users within the corporate network perimeter in most standard deployments.

An insider or compromised low-privileged EBS user authenticates to Oracle E-Business Suite over HTTP and navigates to the UK Payroll component, exploiting the authorization bypass to access payroll records for employees outside their permitted scope or to insert or modify pay-related records. No public proof-of-concept code has been identified, and the attack requires a valid EBS session, limiting opportunistic external exploitation.