Human Resources Management System
Monthly
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker with operating system logon to the infrastructure host to achieve full takeover of the HRMS application. The vulnerability resides in the US Payroll Tax Issues component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, though Oracle flagged this in its August 2026 Critical Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.
Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the module. The flaw is tagged as an authentication bypass and carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged attacker with operating system logon to the infrastructure host to achieve full takeover of the HRMS application. The vulnerability resides in the US Payroll Tax Issues component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, though Oracle flagged this in its August 2026 Critical Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) within Oracle E-Business Suite (US Payroll Year End component) lets a low-privileged, network-based attacker read all HRMS-accessible data and modify some of it. Affected supported releases are 12.2.3 through 12.2.15, addressed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed as actively exploited despite the sensitive payroll data at stake.
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.
Sensitive data disclosure in Oracle HRMS (UK) UK Payroll, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all HRMS-accessible data and modify some of it. The flaw is exploitable by an authenticated user (CVSS 3.1 PR:L) and carries a base score of 7.1 with high confidentiality and low integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle E-Business Suite payroll modules are high-value targets holding PII and financial data.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15 allows a remote attacker to read all HRMS-accessible data over HTTP without credentials. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 with confidentiality-only impact and is easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the module. The flaw is tagged as an authentication bypass and carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.