CVE-2026-61255 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (New Zealand) product of Oracle E-Business Suite (component: New Zealand Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (New Zealand). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (New Zealand) accessible data as well as unauthorized read access to a subset of Oracle HRMS (New Zealand) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (New Zealand) component of the Oracle E-Business Suite, specifically targeting the New Zealand Payroll functionality. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this flaw has persisted across multiple updates. The vulnerability is classified as easily exploitable, meaning that attackers with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP, making it particularly dangerous as it can be executed from remote locations without requiring physical presence or specialized network positioning.
The technical nature of this vulnerability stems from insufficient authorization controls within the payroll processing module, allowing low privileged users to bypass normal access restrictions. This weakness enables unauthorized modification of payroll data through update, insert, and delete operations, while simultaneously permitting read access to sensitive employee information. The vulnerability affects data integrity by allowing malicious actors to alter payroll records, potentially manipulating employee compensation, tax withholdings, or other critical financial data. Additionally, the confidentiality aspect reveals that attackers can access a subset of payroll data without proper authorization, which may include personal employee details, salary information, or transaction histories.
From an operational impact perspective, this vulnerability poses significant risk to organizations utilizing Oracle E-Business Suite for their New Zealand payroll processing. The potential for unauthorized data modification could lead to financial discrepancies, compliance violations, and employee trust erosion. The read access capability means sensitive personal and financial information could be extracted, potentially leading to identity theft or fraud. Organizations may face regulatory penalties under data protection laws such as GDPR or local employment legislation if payroll data is compromised, especially given the sensitive nature of human resources information. The CVSS 3.1 score of 5.4 indicates a medium severity vulnerability that requires immediate attention.
Security mitigations should focus on implementing proper access controls and authentication mechanisms within the Oracle HRMS environment. Organizations must ensure that all affected systems are patched with the latest Oracle security updates, as these typically contain fixes for known vulnerabilities. Network segmentation and firewall rules should be reviewed to limit unnecessary HTTP access to payroll systems, while implementing additional monitoring for unusual data access patterns. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a specific implementation weakness in the authorization framework that could be addressed through proper privilege management and role-based access controls. Organizations should also consider implementing database activity monitoring solutions to detect and alert on unauthorized data modifications, as this would help identify exploitation attempts even if initial defenses are bypassed. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques, specifically targeting the 'Exploitation for Privilege Escalation' tactic where attackers leverage low-privilege accounts to gain higher-level access to sensitive systems and data.