CVE-2026-62549 in HRMS
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (UK) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle HRMS (UK) component of Oracle E-Business Suite, specifically targeting the UK Payroll functionality within versions 12.2.3 through 12.2.15. The flaw represents a critical security weakness that can be exploited by low privileged attackers with network access via HTTP protocols. The vulnerability's exploitability score of 9.6 on the CVSS 3.1 scale indicates severe impact potential, particularly concerning confidentiality and integrity aspects of the affected system. The attack vector is classified as network-based (AV:N) requiring low complexity to exploit (AC:L), with only low privileges needed for successful compromise (PR:L). This vulnerability demonstrates characteristics consistent with CWE-284 Access Control Issues, where insufficient access controls allow unauthorized modifications to critical data.
The operational impact of this vulnerability extends beyond the immediate HRMS (UK) component and can potentially affect additional Oracle E-Business Suite products through scope change mechanisms. This interconnected nature of the attack surface is particularly concerning as it suggests that exploitation of this single vulnerability could provide attackers with access to multiple interconnected systems within the enterprise environment. Attackers who successfully exploit this vulnerability gain unauthorized capabilities to create, delete, or modify critical data within the Oracle HRMS (UK) system, along with complete access to all accessible data. The potential for unauthorized data modification combined with full data access represents a significant threat to both data integrity and confidentiality, particularly given that HRMS systems typically contain sensitive employee information including payroll details, personal identification data, and financial records.
The security implications of this vulnerability align with ATT&CK technique T1078 Valid Accounts, where attackers leverage compromised or low-privileged accounts to gain access to sensitive systems. The CVSS vector indicates a high severity impact with a score of 9.6, reflecting the combination of high confidentiality and integrity impacts (C:H/I:H) while maintaining a relatively low availability impact (A:N). This vulnerability's characteristics suggest it may be related to insufficient input validation or authentication bypass mechanisms within the HTTP request processing layer of the UK Payroll component. Organizations should consider implementing comprehensive monitoring solutions to detect unusual access patterns, particularly around payroll and HR data modifications, as well as ensure proper network segmentation to limit the potential lateral movement of attackers who might exploit this vulnerability. The scope change aspect of this vulnerability indicates that defensive measures must account for potential cascading effects across multiple Oracle E-Business Suite modules rather than treating it as an isolated component issue.
The exploitation of this vulnerability demonstrates the critical importance of maintaining up-to-date security patches and implementing robust access control policies within enterprise ERP systems. Given that this affects a widely deployed component within Oracle E-Business Suite, organizations should conduct immediate vulnerability assessments to identify affected systems and implement appropriate mitigations including network access controls, application firewalls, and comprehensive monitoring solutions. The low privilege requirement for exploitation suggests that even compromised user accounts could potentially leverage this vulnerability to achieve significant system compromise, making it essential for organizations to enforce strict privileged access controls and regular security audits of their Oracle E-Business Suite implementations.