Oracle HRMS EUVD-2026-47561

Exploitation requires network access to the Oracle E-Business Suite HTTP tier and a valid low-privileged EBS account (CVSS PR:L), targeting the Oracle HRMS (UK) UK Payroll component on versions 12.2.3 through 12.2.15; no user interaction and no high privileges are needed (UI:N, AC:L). Limiting factors: the attacker must already authenticate with at least a low-privilege account (this is not a fully anonymous/unauthenticated flaw despite the 'Authentication Bypass' tag, which conflicts with PR:L and should be verified with Oracle), the deployment must be a UK-localized HRMS/Payroll installation in the affected 12.2.x range, and the affected endpoint must be network-reachable by the attacker.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, which Oracle characterizes as 'easily exploitable' - a meaningful prioritization signal for internet- or intranet-exposed EBS instances. The scope change (S:C) elevates concern because impact can extend beyond HRMS (UK) to additional products. However, impact is confidentiality-only (no integrity or availability effect), so this is a data-exposure risk, not a system-takeover or destructive one. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent mass exploitation; the 7.7 rating reflects potential rather than observed exploitation. The provided tag 'Authentication Bypass' is worth flagging as potentially conflicting: the CVSS vector requires PR:L (a low-privileged account), so full pre-authentication bypass is not what the vector describes - verify the exact privilege prerequisite with Oracle before treating this as unauthenticated.

An attacker who has obtained any low-privileged EBS application account (for example, an employee self-service login or a compromised internal user) sends crafted HTTP requests to the UK Payroll functionality and retrieves sensitive payroll and HR data they are not authorized to see. Because the vulnerability carries a scope change, the same access can be pivoted to expose critical data belonging to other integrated Oracle products. No public exploit is identified at time of analysis, so exploitation would currently require independent development.