EUVD-2026-47542
GHSA-788r-4vxm-prp9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Consistent with Oracle-provided vector; low-privilege authenticated HTTP access with partial CIA impacts and no scope change matches the description precisely.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data as well as unauthorized read access to a subset of Oracle HRMS (US) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (US). CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
AnalysisAI
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
Oracle HRMS (US) is the US-localized Human Resources Management System module within Oracle E-Business Suite (EBS) R12.2, a large enterprise application suite widely deployed for ERP, HR, and financial operations. The affected component - US Payroll - General - handles core US payroll processing functions and is exposed over HTTP via Oracle Application Framework (OAF) pages and associated service endpoints. The vulnerability exists across the entire R12.2 release train from 12.2.3 to 12.2.15. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates the vulnerable endpoint is network-reachable with no special configuration required beyond a valid low-privilege EBS account. No CWE classification was provided by NVD or Oracle, leaving the precise root cause class unconfirmed; the partial CIA triad impact pattern (C:L/I:L/A:L) is consistent with an access control or authorization enforcement gap on specific payroll API routes, such as CWE-284 (Improper Access Control) or CWE-639 (Authorization Bypass Through User-Controlled Key).
RemediationAI
Apply the Oracle Critical Patch Update for July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched Oracle EBS version or patch number requires verification via Oracle My Support (MOS), as the source data confirms only the CPU advisory reference and not a specific post-fix release identifier - consult Oracle Support for the applicable patch against your 12.2.x baseline. If immediate patching is not feasible, restrict network access to Oracle HRMS (US) Payroll module endpoints at the network or web application firewall layer to authorized internal IP ranges only, eliminating the network-accessible attack vector for external or untrusted segments (trade-off: this may disrupt remote or VPN-less workforce access). Additionally, audit and tighten Oracle EBS user account provisioning for the HRMS US Payroll module - removing unnecessary low-privilege accounts reduces the pool of potential exploiters, since PR:L authentication is required. Enable and actively monitor Oracle EBS audit logging for the US Payroll - General component to detect unauthorized read or write activity against payroll records. These compensating controls do not eliminate the vulnerability and should be paired with expedited patching.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-200 – Information Exposure
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today