CVE-2026-61036 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Norway) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (Norway) component of the Oracle E-Business Suite, specifically targeting the Norway Payroll module. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure across multiple release cycles. The vulnerability represents a significant security weakness that demonstrates poor access control implementation within the payroll processing system. According to CVSS 3.1 scoring methodology, this flaw carries a base score of 3.8, reflecting moderate severity with specific impact vectors affecting both confidentiality and integrity aspects of the affected data.
The technical exploitation mechanism involves an attacker with high privileges who can leverage network access through HTTP protocols to compromise the system. This attack vector suggests that the vulnerability likely stems from insufficient input validation or improper authentication mechanisms within the web interface components of the Norway Payroll module. The flaw enables unauthorized modification operations including update, insert, and delete actions against specific data sets within the HRMS environment, while also permitting read access to restricted information subsets. The CVSS vector analysis reveals that the attack requires high privileges (PR:H) indicating that this is not a straightforward privilege escalation issue but rather involves an attacker who has already established some level of administrative access within the system.
The operational impact of this vulnerability extends beyond simple data compromise, as it can result in both unauthorized modification and reading of sensitive payroll information. Payroll data typically contains highly confidential employee compensation details, tax information, and personal identifiers that require strict protection under various regulatory compliance frameworks including gdpr, hipaa, and soc 2 standards. The potential for unauthorized data manipulation poses significant risks to financial accuracy and employee privacy, while the read access capability could lead to information disclosure that might be exploited for further attacks or fraudulent activities.
Organizations affected by this vulnerability should implement immediate mitigations including network segmentation to restrict HTTP access to payroll systems, enhanced monitoring of payroll module activities, and thorough review of existing administrative accounts. The vulnerability aligns with CWE categories related to improper access control and insufficient input validation, which are commonly exploited in enterprise applications. From an ATT&CK framework perspective, this represents a privilege escalation and credential access technique that could be leveraged for lateral movement within the organization's network infrastructure. Security teams should prioritize patch management activities and consider implementing additional controls such as database activity monitoring and privileged account management to reduce risk exposure from this vulnerability.