CVE-2026-62465 in HRMS US
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HRMS (US) as well as unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data and unauthorized read access to a subset of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (US) component of the Oracle E-Business Suite ecosystem, specifically targeting the Internal Operations functionality. The affected versions span from 12.2.9 through 12.2.15, representing a significant portion of the product lifecycle that organizations continue to utilize in production environments. The vulnerability's classification as easily exploitable indicates that attack vectors requiring minimal skill or resources can successfully compromise the system, making it particularly dangerous for organizations with less robust security controls.
The technical flaw manifests as a privilege escalation vulnerability that permits low-privileged attackers who have already gained logon access to the underlying infrastructure hosting Oracle HRMS (US) to escalate their privileges and gain unauthorized access to critical system functions. This represents a classic case of insufficient access control mechanisms within the application's internal operations framework, where proper authorization checks fail to validate the attacker's elevated privileges before allowing access to sensitive operations. The vulnerability's CVSS 3.1 score of 6.6 reflects the balanced impact across confidentiality, integrity, and availability domains, with availability receiving the highest weight due to the potential for complete denial of service conditions.
The operational impact of this vulnerability extends beyond simple data compromise to include comprehensive system disruption capabilities. Attackers can induce hang conditions or create frequently repeatable crashes that result in complete denial of service against the Oracle HRMS (US) application, effectively rendering critical human resources and payroll functionality unavailable. Additionally, the vulnerability enables unauthorized modification of data through update, insert, and delete operations, while simultaneously providing read access to sensitive subsets of HRMS data. This dual impact on both data integrity and availability creates significant operational risk for organizations relying on accurate personnel information, payroll processing, and related business functions.
Organizations should immediately implement compensating controls including network segmentation to limit access to Oracle HRMS (US) systems, enhanced monitoring of system access logs for unusual privilege escalation patterns, and regular security assessments of the underlying infrastructure. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a potential pathway for attackers to achieve persistence within enterprise environments through the ATT&CK framework's privilege escalation techniques. Security teams should prioritize patch management initiatives and consider implementing additional authentication controls including multi-factor authentication for administrative access to Oracle HRMS (US) systems, particularly given the low attack complexity and high impact potential.