CVE-2026-61214 in E-Business Suite
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (UK) component of the Oracle E-Business Suite, specifically targeting the UK Payroll functionality. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure where organizations utilizing this payroll system remained susceptible to potential exploitation. The vulnerability classification as difficult to exploit suggests that while the attack vector is accessible, it requires specific conditions and expertise to successfully compromise the system. The security posture is further complicated by the requirement for an attacker with high privileges, indicating that this vulnerability likely targets administrative or elevated user accounts rather than standard user access points.
The technical flaw manifests through HTTP network access, making it accessible to attackers who can establish connections to the Oracle HRMS (UK) application layer. This represents a significant concern as HTTP traffic typically flows through standard network protocols and may be intercepted or manipulated by threat actors positioned within network perimeters. The vulnerability's classification under CVSS 3.1 with a base score of 2.2 indicates low severity in terms of overall impact, yet the confidentiality impact rating of 'low' suggests that successful exploitation could enable unauthorized read access to sensitive data within the payroll system. This aligns with CWE-284 (Improper Access Control) and potentially CWE-312 (Cleartext Storage of Sensitive Information) if the vulnerability involves improper authentication mechanisms or data exposure.
The operational impact of this vulnerability extends beyond simple data theft, as payroll information represents highly sensitive employee data including salary details, tax information, and personal identifiers. Even a subset of accessible data could provide attackers with valuable intelligence for further exploitation or identity theft activities. The fact that this affects the UK Payroll component specifically suggests implications for organizations operating in the United Kingdom, potentially affecting compliance with local data protection regulations such as GDPR. Organizations utilizing Oracle E-Business Suite versions within the affected range must consider the potential for credential compromise and subsequent unauthorized access to financial and personal employee information.
Mitigation strategies should focus on immediate patching of affected Oracle E-Business Suite installations to version 12.2.16 or later, which would address the identified vulnerability through security updates provided by Oracle. Network segmentation and access control measures should be implemented to limit HTTP access to the payroll application layer, ensuring that only authorized administrative personnel can establish connections to these systems. Additionally, organizations should review and strengthen their authentication mechanisms for payroll applications, potentially implementing multi-factor authentication or additional access controls. The vulnerability's CVSS vector indicates that while it requires high privileges and has a high access complexity, the potential for unauthorized data read access necessitates immediate attention. This aligns with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers may need to first obtain elevated credentials before exploiting this specific vulnerability. Regular security assessments and monitoring of network traffic for unusual HTTP requests targeting payroll systems should be implemented as part of ongoing security operations.