Oracle HRMS (US) EUVD-2026-62044

Exploitation requires an existing low-privileged OS-level logon session on the infrastructure host where Oracle HRMS (US) executes - this is the hard prerequisite per the CVSS AV:L/PR:L vector. The attacker does not need Oracle application-layer credentials, only an OS shell. The vulnerability is in the US Payroll Tax Issues component specifically, implying the component must be in use (i.e., a US-configured EBS instance). Exploitation is limited to users or processes with physical or remote shell access to the EBS application tier; it is not remotely exploitable over the network without a prior foothold. No user interaction from a privileged user is required (UI:N), and no special system configuration beyond standard EBS deployment is indicated. The scope is unchanged (S:U), meaning impact is confined to the HRMS application itself rather than escaping to adjacent systems.

The CVSS 3.1 score of 7.8 reflects a high-severity local vulnerability: AC:L (no special conditions), PR:L (low OS privileges sufficient), UI:N (no user interaction), and full C/H/I/H/A/H impact. While the score is high, the local attack vector (AV:L) significantly constrains the realistic threat surface - an attacker must already have a shell or logon session on the EBS application server. This limits exploitation to insiders, compromised service accounts, or attackers who have achieved an initial foothold via a separate vulnerability. No EPSS data was provided, KEV status is negative, and no public POC is known, all of which reduce urgency relative to remotely exploitable issues of similar CVSS. The 'Information Disclosure' tag in EUVD metadata partially conflicts with the description's claim of full takeover (C+I+A:H, including integrity and availability); this discrepancy may reflect incomplete tagging rather than a technical contradiction, but defenders should treat the broader impact as plausible given Oracle's explicit 'takeover' language. Risk is real for environments where shared infrastructure access is common - e.g., EBS running on shared Unix hosts with multiple OS users.

An attacker who has obtained a low-privileged OS account on the Oracle EBS application server - whether through credential theft, lateral movement, or insider access - interacts with the US Payroll Tax Issues component locally to escalate privileges and achieve full control of the HRMS application. With full C/I/A compromise, the attacker could exfiltrate sensitive payroll and employee tax data, tamper with payroll records, or disrupt the application's availability. No public exploit code exists at time of analysis, so exploitation currently requires attacker-developed tooling or manual exploitation technique.