Oracle HRMS (US) EUVD-2026-47542

Exploitation requires a valid Oracle E-Business Suite authenticated account with at least low-level privileges (PR:L per the CVSS vector - unauthenticated exploitation is not indicated). The affected organization must have the Oracle HRMS (US) module deployed and the US Payroll - General component active; organizations not running US Payroll are not affected. The attack is delivered over HTTP on the network (AV:N) with no user interaction and low complexity, meaning no unusual configuration beyond a standard EBS deployment is required. Exploitation is limited by: the mandatory authenticated EBS account prerequisite (not anonymous), the scope being unchanged (S:U - impact confined to the Oracle HRMS application, not the broader OS or database layer), and the requirement that the US Payroll component specifically be installed and accessible. Organizations that restrict Oracle EBS access to internal networks or authenticated VPN tunnels significantly reduce the effective attack surface by negating the open network vector.

The CVSS 3.1 score of 6.3 (Medium) accurately captures a real but bounded risk. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N), but exploitation demands at minimum a low-privileged authenticated EBS account (PR:L) - this is the primary gatekeeping factor. The scope is unchanged (S:U), confining impact to the Oracle HRMS application itself. Confidentiality, integrity, and availability impacts are all partial (C:L/I:L/A:L), meaning this is not a full system compromise but could expose sensitive payroll records and allow unauthorized data manipulation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept exploit code has been identified, indicating no confirmed active exploitation at time of analysis. For organizations with Oracle EBS exposed beyond internal network boundaries or VPN, the risk is elevated since the network attack vector becomes externally reachable. For organizations with strict internal network segmentation and well-managed EBS accounts, the real-world risk is mitigated significantly by the authentication prerequisite. Given the sensitivity of US payroll data, even partial confidentiality and integrity impacts warrant prompt action regardless of the medium CVSS score.

An authenticated Oracle EBS user with a low-privilege account - such as an HR coordinator, contractor account, or a compromised service account - sends crafted HTTP requests to the US Payroll - General component, exploiting the access control weakness to read payroll records beyond their authorization, manipulate payroll entries such as salary or deduction records, or trigger partial availability degradation of the payroll module. No public exploit code exists at time of analysis, so exploitation currently requires attacker-specific knowledge of the vulnerable endpoint or parameter, likely discoverable through enumeration of EBS OAF page URLs or API routes.