Oracle HRMS (US) EUVD-2026-61645

Exploitation requires that the attacker already holds high-privilege credentials within Oracle E-Business Suite (PR:H) - this excludes unauthenticated external attackers entirely. Network access to the application tier over HTTP must be available, and the attacker must satisfy high attack complexity (AC:H), which typically implies specific timing conditions, configuration states, or multi-step preconditions not fully disclosed in public advisories. The vulnerability is specific to the US Payroll - General component, meaning Oracle EBS deployments that do not license or configure US Payroll are not exposed. Affected versions are strictly 12.2.3 through 12.2.15; installations outside this range are not confirmed vulnerable. No user interaction is required (UI:N), meaning an attacker who can reproduce the attack conditions does not need to socially engineer another user. The primary limiting factors are the mandatory high-privilege pre-condition and high attack complexity, which together restrict exploitation to insiders or threat actors who have already achieved significant footholds within the target environment.

The CVSS 8.0 base score reflects a serious but meaningfully constrained threat: network access via HTTP is required, but the attacker must already hold high-privilege credentials (PR:H) and navigate high attack complexity (AC:H), substantially narrowing the realistic attacker population to insiders, compromised admin accounts, or sophisticated threat actors. The scope change (S:C) is the most strategically significant element - exploitation does not terminate at the HRMS boundary but can propagate into interconnected E-Business Suite modules, multiplying the operational and data-integrity risk. No EPSS score was present in the provided input data, which limits probabilistic exploitation forecasting; this absence should be noted as a gap. This CVE does not appear in CISA KEV and no public proof-of-concept has been identified, which reduces immediate urgency relative to exploited-in-the-wild findings. The combination of PR:H and AC:H means that even a mid-sized municipal IT team in inowroclaw running Oracle EBS for payroll processing could reasonably deprioritize this below unauthenticated or low-complexity vulnerabilities - however, the full C/I/A takeover outcome and cross-module scope change should prevent complacency, particularly in environments where privileged EBS accounts are shared, delegated broadly, or inadequately monitored. The 'Information Disclosure' tag in the intelligence metadata appears inconsistent with the full C:H/I:H/A:H impact vector and likely underrepresents true severity; this discrepancy should be verified directly against the Oracle advisory.

A highly privileged Oracle EBS account holder - such as a payroll system administrator or a threat actor who has already compromised such credentials - crafts a specific HTTP request targeting the US Payroll - General component, satisfying the high attack complexity conditions required to trigger the vulnerability. Upon successful exploitation, the attacker achieves full control of the Oracle HRMS (US) application, including access to sensitive payroll and HR data, with the scope change enabling lateral movement into adjacent E-Business Suite modules such as Oracle Financials or General Ledger. No public proof-of-concept has been identified, and the PR:H and AC:H requirements constrain this scenario to sophisticated or insider threat actors rather than opportunistic external attackers.