CVE-2026-62530 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (France) component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that operates at the application layer, where an attacker with minimal privileges can exploit network-based HTTP access to gain unauthorized access to sensitive human resources data. The vulnerability's classification as easily exploitable indicates that the attack vector requires no specialized skills or tools beyond standard network reconnaissance and exploitation techniques, making it particularly dangerous for organizations relying on this payroll and HR management system.
The technical nature of this vulnerability stems from inadequate access controls within the French HRMS component, allowing an attacker with low privilege network access to manipulate critical data through HTTP requests. This weakness aligns with CWE-284 Access Control Issues, specifically manifesting as insufficient authorization checks that permit unauthorized data modification or deletion operations. The vulnerability's impact extends beyond simple data theft to include complete compromise of the system's integrity, enabling attackers to create, delete, or modify all accessible HR data without proper authentication or authorization. This represents a severe degradation of both confidentiality and integrity controls within the Oracle E-Business Suite environment.
From an operational standpoint, this vulnerability poses substantial risk to organizations using Oracle E-Business Suite for human resources management, particularly those in France where the French HRMS component is specifically designed to comply with local labor regulations and data protection requirements. The CVSS 3.1 base score of 8.1 indicates high severity with high confidentiality and integrity impacts, suggesting that successful exploitation could lead to complete data compromise across the entire HR database. Attackers could potentially access sensitive employee information including personal identification details, salary records, performance evaluations, and other confidential personnel data, with implications for both regulatory compliance and organizational security posture.
The vulnerability's exploitability characteristics present a significant challenge for security teams as it requires minimal privileges and network access to achieve maximum impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) confirms that the attack can be executed over the network with low complexity, requiring only low privilege user credentials, and does not require user interaction or system compromise. Organizations should implement immediate mitigations including applying Oracle's security patches, implementing network segmentation to limit access to HRMS components, and deploying web application firewalls to monitor and restrict HTTP traffic to these critical systems. Additionally, organizations must conduct thorough vulnerability assessments to identify all instances of affected Oracle E-Business Suite versions and ensure proper access controls are implemented through role-based access control mechanisms that align with the principle of least privilege and defense-in-depth strategies recommended by cybersecurity frameworks including NIST SP 800-53 and ISO/IEC 27001 standards.