CVE-2026-60965 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (France) component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that operates at the application layer and can be exploited remotely by attackers with minimal privileges. The vulnerability's classification as easily exploitable indicates that the attack vector requires no specialized skills beyond basic network access, making it particularly dangerous in production environments where such systems are often exposed to external networks.
The technical nature of this flaw involves insufficient authorization controls within the French HRMS module, allowing a low-privileged attacker who can establish HTTP connections to the affected system to gain unauthorized access to critical data and functionality. This represents a severe privilege escalation vulnerability that operates below the application's normal security boundaries. The vulnerability's CVSS 3.1 base score of 8.1 reflects its high severity, with both confidentiality and integrity impacts rated as high, indicating that successful exploitation could result in complete data compromise and modification capabilities.
Attackers can leverage this vulnerability to perform unauthorized operations including creation, deletion, and modification of critical human resources data within the Oracle HRMS (France) system. The impact extends beyond simple data access to include full modification capabilities, potentially allowing attackers to alter employee records, salary information, or other sensitive personnel data. This type of vulnerability typically maps to CWE-284 (Improper Access Control) and may also align with ATT&CK techniques such as T1078 (Valid Accounts) and T1566 (Phishing) for initial access, followed by T1003 (OS Credential Dumping) or T1074 (Data Staged) for lateral movement and data extraction.
The operational impact of this vulnerability extends to business continuity and regulatory compliance considerations, particularly in industries subject to strict data protection regulations such as GDPR or SOX compliance requirements. Organizations utilizing these Oracle E-Business Suite versions must consider the potential for significant financial and reputational damage from successful exploitation. The vulnerability affects not only individual employee records but could potentially compromise entire HR databases, making it a critical target for threat actors seeking to disrupt business operations or extract sensitive personal information.
Mitigation strategies should include immediate application of Oracle's security patches and updates, implementation of network segmentation to limit access to the vulnerable system, and enhanced monitoring of HTTP traffic for suspicious activity. Organizations should also review and enforce least privilege access controls, implement web application firewalls, and conduct comprehensive vulnerability assessments to identify similar issues within their Oracle E-Business Suite deployments. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that network-based attacks are possible with low complexity but require only low privilege levels, making this vulnerability particularly attractive to attackers seeking broad system access without requiring elevated credentials or complex attack chains.