What is the CVSS score of EUVD-2026-47500?

EUVD-2026-47500 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle HRMS (UK) EUVD-2026-47500

| CVE-2026-62453 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wphv-96w4-xp47

Denial Of Service Information Disclosure Oracle Human Resources Management System

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP endpoint requires low-privileged auth (PR:L); no complexity or interaction; scope unchanged; all three impacts are partial (Low), consistent with Oracle's description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (UK). CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle HRMS (UK) is a regional module of Oracle E-Business Suite (EBS) that manages UK-specific HR and payroll operations. The affected component, Internal Operations, is exposed over HTTP, indicating it is likely a web-facing application tier endpoint within the EBS framework. Supported affected versions span 12.2.3 through 12.2.15, a broad release range suggesting the vulnerability may be longstanding in the codebase. No CWE identifier was provided by Oracle or NVD, which is consistent with Oracle's practice of withholding root-cause details; the combination of low-privilege requirement and multi-category impact (C/I/A) is indicative of improper authorization or access control deficiencies in the Internal Operations API or servlet layer. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L confirms the flaw is directly reachable over the network without complexity or user interaction beyond possessing a low-privileged account.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish precise patched version numbers outside of its My Oracle Support portal; customers should consult MOS Note and the CPU advisory for the specific patch set identifier applicable to their 12.2.x installation. As a compensating control prior to patching, restrict network access to the Internal Operations component at the application tier or web server level, limiting HTTP reachability to only those user roles that require it - this reduces the low-privileged attacker pool. Additionally, review and audit low-privileged EBS user accounts to ensure principle of least privilege is enforced, reducing the likelihood of a compromised account being leveraged. Note that EBS patches typically require downtime for application; plan patching windows accordingly. No workaround that eliminates the vulnerability has been identified outside of Oracle's official CPU.