Oracle HRMS EUVD-2026-47560

Exploitation requires network access to the Oracle EBS HTTP interface and a low-privileged authenticated account (CVSS PR:L), targeting the Oracle HRMS (US) US Payroll Year End component on supported versions 12.2.3-12.2.15; no user interaction is needed (UI:N) and attack complexity is low (AC:L, 'easily exploitable' per Oracle). Limiting factors: an existing valid EBS credential is needed (this is not confirmed pre-authentication despite the 'Authentication Bypass' tag, which conflicts with PR:L and should be verified with Oracle), the EBS HRMS module and US Payroll functionality must be deployed and reachable, and the instance must be at an unpatched 12.2.x level. Impact is bounded to confidentiality (full read of HRMS-accessible data) and partial integrity (update/insert/delete of some data), with no availability impact (A:N).

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N: remotely reachable over HTTP, low attack complexity, low privileges, no user interaction, high confidentiality impact, low integrity impact, no availability impact. Oracle explicitly describes it as 'easily exploitable', reinforcing the AC:L/PR:L reading - any authenticated low-privilege EBS user could reach all HRMS-accessible data. Countervailing signals lower urgency: there is no EPSS score in the provided data, no CISA KEV listing, and no public POC, so exploitation is not confirmed and no probability metric is available. Net assessment: a genuine priority for organizations running EBS HRMS because it exposes sensitive payroll/PII with only a low-privilege foothold, but not an emergency zero-day - no evidence of in-the-wild use. Note the conflict between the 'Authentication Bypass' tag (implies no auth) and PR:L (implies an account is needed); verify the true privilege prerequisite with Oracle before finalizing risk.

An attacker who holds any low-privileged Oracle EBS account (for example an employee self-service login) sends crafted HTTP requests to the US Payroll Year End functionality and retrieves payroll and PII records belonging to other users, then alters some of that HRMS data. No user interaction or elevated privileges are required, and the network HTTP vector with low complexity makes exploitation straightforward for an authenticated insider or anyone who has phished a single valid account. No public POC is identified at time of analysis.