CVE-2026-60950 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Ireland). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (Ireland) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (Ireland) component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a security weakness that can be exploited by attackers with high privileges and network access through HTTP protocols. From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and falls under the ATT&CK technique T1078 (Valid Accounts) as it requires elevated privileges for exploitation. The affected component operates within the Internal Operations framework of Oracle E-Business Suite, which handles critical human resources and payroll functions in enterprise environments.
The technical nature of this vulnerability manifests as a confidentiality impact allowing unauthorized read access to specific data subsets within the Oracle HRMS (Ireland) system. Attackers with high privileged access and network connectivity via HTTP can exploit this weakness to extract sensitive information without triggering obvious detection mechanisms. The CVSS 3.1 scoring of 2.2 reflects the low to medium severity classification, with the base vector indicating network accessibility (AV:N), high attack complexity (AC:H), high privilege requirements (PR:H), and no user interaction needed (UI:N). The vulnerability affects only the confidentiality aspect of the system, meaning attackers cannot modify or disrupt operations but can access sensitive data.
The operational impact of this vulnerability extends beyond simple data theft, particularly in enterprise environments where HRMS systems contain highly sensitive employee information including personal identification numbers, salary details, performance records, and other confidential personnel data. Organizations using affected Oracle E-Business Suite versions face potential compliance violations under regulations such as GDPR, HIPAA, and SOX due to unauthorized data access. The limited scope of the vulnerability means it affects only a subset of accessible data rather than complete system compromise, but the sensitive nature of human resources information makes this still a significant concern for enterprise security teams.
Organizations should implement immediate mitigation strategies including applying Oracle's recommended security patches and updates for the affected versions. Network segmentation and access controls should be enhanced to limit HTTP access to only necessary administrative systems. Regular monitoring of network traffic for suspicious HTTP requests and implementing database activity monitoring solutions can help detect potential exploitation attempts. Security teams should also conduct privilege reviews to ensure that only authorized personnel maintain high-privilege accounts, following the principle of least privilege as outlined in NIST SP 800-53 security controls. Additionally, organizations should review their incident response procedures to address potential data exposure scenarios involving human resources information systems.