CVE-2026-61251 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the HRMS (Australia) product of Oracle E-Business Suite (component: Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise HRMS (Australia). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all HRMS (Australia) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's HRMS (Australia) component, specifically within the Payroll module of versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that can be exploited by adversaries with minimal privileges and network connectivity through HTTP protocols. The vulnerability's classification as easily exploitable indicates that attackers require little specialized knowledge or resources to leverage this weakness effectively.
The technical nature of this vulnerability stems from insufficient access controls within the payroll processing functionality, allowing low-privileged users to bypass normal authorization mechanisms. This weakness creates a pathway for unauthorized data access that can extend to critical human resources information including employee records, compensation details, and sensitive payroll data. The CVSS 3.1 score of 6.5 reflects the high confidentiality impact potential, where successful exploitation could lead to complete data compromise without requiring additional privileges or user interaction.
Operational impacts of this vulnerability extend beyond simple data theft, as compromised payroll systems can undermine organizational integrity and regulatory compliance. The affected environment represents a critical business application that handles sensitive personal and financial information, making unauthorized access particularly damaging. Organizations utilizing these specific Oracle E-Business Suite versions face potential exposure to industrial espionage, identity theft, and regulatory violations under data protection frameworks such as GDPR or local privacy legislation. The vulnerability's network accessibility means that remote attackers could potentially exploit this weakness from outside the corporate perimeter without requiring physical access or elevated privileges.
Mitigation strategies should prioritize immediate patch deployment for affected Oracle E-Business Suite versions, following Oracle's security advisory releases and implementing proper network segmentation to limit access to payroll systems. Organizations should also conduct comprehensive access control reviews, implement additional authentication layers, and establish monitoring protocols to detect unauthorized access attempts. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). Regular security assessments and vulnerability scanning should be implemented to identify similar weaknesses in related systems, while privileged account management practices must be reinforced to minimize potential impact from such access control failures.