CVE-2026-61075 in Self-Service Human Resources
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data as well as unauthorized read access to a subset of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Self-Service Human Resources component, specifically in the Internal Operations functionality that governs employee self-service capabilities. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this weakness has persisted across multiple maintenance cycles. The vulnerability manifests as an insufficient authorization check that allows attackers with minimal privileges to exploit HTTP-based network access points to gain unauthorized data manipulation capabilities.
The technical flaw stems from inadequate input validation and access control mechanisms within the internal operations processing layer of the human resources module. Attackers can leverage this weakness through standard web protocols without requiring elevated privileges or specialized tools, making it particularly concerning for production environments where network exposure is common. The vulnerability's exploitability score of low indicates that the attack requires minimal technical expertise and can be executed from external network positions, potentially allowing adversaries to bypass normal authentication controls that should protect sensitive HR data.
The operational impact of this vulnerability extends beyond simple data access issues, as it enables unauthorized modification of critical human resources information including employee records, compensation details, and personnel configurations. The confidentiality aspect reveals that attackers can read limited subsets of accessible data, potentially exposing sensitive personal information and organizational data that should remain protected within the HR system. Integrity implications suggest that malicious actors could alter or corrupt employee data, leading to operational disruptions and potential compliance violations. The absence of availability impact indicates that while data integrity and confidentiality are compromised, the system's core functionality remains operational.
This vulnerability aligns with CWE-284 (Improper Access Control) and maps to attack patterns within the ATT&CK framework under privilege escalation and credential access categories. Organizations utilizing Oracle E-Business Suite should prioritize immediate patch deployment and network segmentation measures to isolate vulnerable systems from untrusted networks. Additional mitigations include implementing web application firewalls, monitoring for anomalous HTTP traffic patterns, and conducting comprehensive access control reviews to ensure proper segregation of duties within HR systems. The CVSS 3.1 score of 5.4 indicates a medium severity risk that requires urgent attention, particularly in environments where the affected module handles sensitive employee data or where network exposure is unavoidable due to business requirements.