CVE-2026-61123 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (US) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (US). CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (US) component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a security weakness that can be exploited by adversaries with minimal privileges and network access through HTTP protocols. The vulnerability classification as difficult to exploit indicates that while the attack requires some technical skill and reconnaissance, it remains within the realm of feasible threat actor capabilities. The affected component Internal Operations suggests this issue impacts core administrative functions within the human resources management system.
The technical nature of this vulnerability manifests as a privilege escalation path that allows low-privileged attackers to gain unauthorized access to sensitive data within the Oracle HRMS (US) environment. This unauthorized read access affects only a subset of accessible data rather than complete system compromise, indicating a targeted information disclosure vulnerability. Additionally, successful exploitation enables attackers to cause partial denial of service conditions, disrupting normal operational functionality while maintaining some system availability. The CVSS 3.1 score of 4.2 reflects the moderate severity level, with confidentiality and availability impacts rated as low to medium. This assessment places the vulnerability in the category of risks that require immediate attention but do not represent critical system compromises.
The operational impact extends beyond simple data exposure, as partial denial of service can disrupt HR processes, employee management functions, and administrative workflows that depend on the affected system components. Organizations utilizing these Oracle E-Business Suite versions face potential compromise of sensitive human resources data including employee records, payroll information, and personnel management details. The HTTP-based attack vector suggests that this vulnerability could be exploited remotely without requiring physical access to the network infrastructure, making it particularly concerning for distributed enterprise environments. This type of vulnerability commonly maps to CWE-284 (Improper Access Control) and may align with ATT&CK techniques involving credential access and privilege escalation.
Mitigation strategies should prioritize immediate patch deployment for affected Oracle E-Business Suite versions, as Oracle typically provides security updates through their regular release cycles. Network segmentation and firewall rules can help limit exposure by restricting HTTP access to only authorized administrative networks. Implementing additional authentication controls and monitoring access patterns can aid in early detection of exploitation attempts. Organizations should also consider disabling unnecessary HTTP services and implementing robust logging mechanisms to track access to HRMS components. The vulnerability's classification as low privilege but network-accessible makes it particularly important for security teams to monitor for potential abuse, especially given that many organizations maintain HR systems with extensive data exposure risks. Regular vulnerability assessments and penetration testing can help identify similar weaknesses in related Oracle applications within the broader E-Business Suite ecosystem.