CVE-2026-61117 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (UK) component of the Oracle E-Business Suite, specifically within the Internal Operations module. The affected versions span from 12.2.8 through 12.2.15, indicating a prolonged period of exposure where organizations have been susceptible to potential exploitation. The vulnerability's classification as difficult to exploit suggests that while it requires some level of skill or specific conditions to be successfully leveraged, the attack surface remains accessible to threat actors with sufficient resources and determination.
The technical flaw manifests as an authorization bypass vulnerability that allows a low-privileged attacker to gain unauthorized access to critical data within the Oracle HRMS (UK) environment. The attack vector is through HTTP network access, meaning that an adversary could potentially exploit this weakness from remote locations without requiring physical presence or elevated privileges initially. This characteristic places significant risk on organizations that expose their HRMS applications directly to external networks or have insufficient network segmentation controls in place.
The operational impact of successful exploitation extends beyond the immediate scope of Oracle HRMS (UK) and can affect additional products within the broader Oracle E-Business Suite ecosystem, representing a scope change that amplifies the potential damage. This cascading effect suggests that the vulnerability may serve as a foothold for more extensive attacks across interconnected systems, potentially enabling attackers to access sensitive personnel data, financial records, or other confidential information stored within the integrated suite of applications.
From a security controls perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant weakness in the application's authorization mechanisms. The CVSS 3.1 score of 6.3 reflects the moderate to high severity impact, with the confidentiality impact rated as high, indicating that successful exploitation could lead to complete data compromise. The vector notation CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N illustrates that while network-based attacks are possible, they require high attack complexity, low privileges, and no user interaction, but can result in a significant scope change affecting critical confidentiality impacts.
Organizations should prioritize patch management and immediate implementation of security controls to address this vulnerability. The recommended mitigations include applying the relevant Oracle patches, implementing network segmentation to limit direct access to HRMS applications, deploying web application firewalls for additional monitoring, and conducting thorough access control reviews. Additionally, organizations should consider implementing network-based intrusion detection systems to monitor for potential exploitation attempts and establish comprehensive incident response procedures to quickly address any successful breach attempts. The vulnerability's characteristics also suggest that regular security assessments and penetration testing should be conducted to identify similar authorization bypass weaknesses in other applications within the Oracle E-Business Suite environment, as these types of vulnerabilities often indicate broader architectural security issues that may affect multiple components within enterprise application suites.