What is the CVSS score of EUVD-2026-47558?

EUVD-2026-47558 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle HRMS EUVD-2026-47558

| CVE-2026-62562 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v9mr-r78h-8w48

Authentication Bypass Oracle Human Resources Management System

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via HTTP with low complexity; low-privilege account required; high confidentiality impact only; no integrity or availability impact per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.

Technical ContextAI

Oracle HRMS (US) is the Human Resources Management System module within Oracle E-Business Suite (EBS), a large-scale enterprise application platform widely deployed in government, healthcare, and corporate environments. The affected component, Internal Operations, governs core HR data processing workflows. The vendor-provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates the flaw is reachable over HTTP with low complexity and requires only a low-privileged session. No CWE identifier was assigned in available data; however, the EUVD tag 'Authentication Bypass' suggests the root cause may be an improper authorization check - where a low-privileged user can access data objects or API endpoints restricted to higher-privileged roles. There is a tension between the 'Authentication Bypass' tag and the PR:L metric: PR:L confirms some authentication is required, suggesting this may be more accurately described as a privilege escalation within authorization controls rather than a complete bypass of authentication. Affected versions span 12.2.3 through 12.2.15 of the EBS 12.2.x release family.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle delivers EBS patches as cumulative bundles; consult the CPU advisory for the specific patch number applicable to Oracle E-Business Suite 12.2.x. No exact patched version number is independently confirmed in available data beyond the CPU advisory reference. As a compensating control prior to patching, restrict HTTP access to the Oracle EBS Internal Operations component to a minimal set of trusted internal IP ranges using network-layer controls, reducing the attack surface to trusted authenticated users only. Additionally, audit and remove unnecessary low-privilege EBS accounts to limit the pool of potential attackers. Note that network restriction may affect legitimate HR staff access and should be coordinated with operations teams before implementation.