EUVD-2026-62044
GHSA-r7w2-953q-ffc9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector confirmed by component architecture; low privileges sufficient per description; full C/I/A impact consistent with Oracle's stated takeover outcome.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker with operating system logon to the infrastructure host to achieve full takeover of the HRMS application. The vulnerability resides in the US Payroll Tax Issues component and results in complete compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing low-privileged OS-level logon session on the infrastructure host where Oracle HRMS (US) executes - this is the hard prerequisite per the CVSS AV:L/PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 reflects a high-severity local vulnerability: AC:L (no special conditions), PR:L (low OS privileges sufficient), UI:N (no user interaction), and full C/H/I/H/A/H impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Patch Update (CPU), available via My Oracle Support and referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Oracle E-Business Suite deployments running HRMS versions 12.2.3 through 12.2.15 and classify systems by criticality (payroll processing, tax withholding, employee data). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged rem
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today