CVE-2026-61260 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (UK) component of the Oracle E-Business Suite, specifically targeting the UK Payroll functionality. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product lifecycle where organizations have deployed this payroll processing module. The vulnerability represents a critical security weakness that enables attackers with minimal privileges to exploit network-based HTTP access points and compromise the underlying HRMS (UK) system. This flaw demonstrates the inherent risks associated with payroll systems that handle sensitive employee financial data, making them attractive targets for adversaries seeking unauthorized access to compensation information.
The technical nature of this vulnerability stems from insufficient access controls within the UK Payroll component, allowing attackers with low privilege network access to execute unauthorized operations against the system. Attackers can leverage HTTP connections to perform unauthorized update, insert, or delete operations on specific data sets within Oracle HRMS (UK), while also gaining read access to subsets of accessible data. The CVSS 3.1 score of 5.4 reflects the moderate severity impact, with confidentiality and integrity being the primary affected components. The attack vector requires network access with low complexity and privilege requirements, making exploitation relatively straightforward for determined adversaries who can establish HTTP connections to the target system.
The operational impact of this vulnerability extends beyond simple data compromise, as payroll systems contain highly sensitive information including employee salaries, benefits details, tax information, and personal identification data. Unauthorized modification of payroll records could result in financial losses, regulatory compliance violations, and potential fraud scenarios where attackers might alter employee compensation or create fraudulent payroll entries. The read access capabilities expose sensitive personnel data that could be used for identity theft, social engineering attacks, or further targeting within the organization. Organizations utilizing Oracle HRMS (UK) must consider the cascading effects of such compromises, particularly in environments where payroll systems integrate with other financial and human resources applications.
Mitigation strategies should prioritize immediate patching of affected Oracle E-Business Suite versions to address the identified access control weakness. Network segmentation and firewall rules should be implemented to restrict HTTP access to payroll systems, limiting exposure to unauthorized network connections. Access controls should be enhanced through proper user privilege management, ensuring that only authorized personnel maintain access to HRMS (UK) functionality. Security monitoring should be strengthened to detect unusual access patterns or unauthorized data modifications within payroll systems. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a typical example of insufficient authorization checks that attackers can exploit to gain elevated privileges within enterprise applications.
Organizations should conduct comprehensive risk assessments to identify all instances of affected Oracle HRMS (UK) installations and implement layered security controls beyond simple patching. Network access controls should be enforced through secure authentication mechanisms, including multi-factor authentication for administrative access to payroll systems. Regular security audits of database access logs should be performed to identify potential unauthorized access attempts. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques, where attackers leverage weak access controls to gain unauthorized system modifications. This represents a common attack pattern in enterprise environments where legacy applications contain unaddressed access control vulnerabilities that persist across multiple software versions.