CVE-2026-62560
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). While the vulnerability is in Oracle HRMS (Norway), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (Norway) component of the Oracle E-Business Suite, specifically targeting the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, representing a substantial portion of the product lifecycle where this security gap was present. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise to leverage this flaw effectively. The attack vector involves network access via HTTP protocol, making it particularly dangerous as it can be initiated from remote locations without requiring physical access to the target system.
The technical nature of this vulnerability allows a low-privileged attacker to gain unauthorized access to critical data within the Oracle HRMS (Norway) environment. This represents a significant security concern given that the component handles sensitive human resources information including employee records, payroll data, and other confidential personnel details. The CVSS 3.1 base score of 7.7 reflects the high severity impact on confidentiality, with the vector indicating network accessibility (AV:N), low attack complexity (AC:L), and requiring only low privileges (PR:L) for successful exploitation. The scope change aspect of this vulnerability means that while initially targeting HRMS (Norway), successful attacks can potentially extend impacts to additional Oracle products within the suite.
The operational implications of this vulnerability are severe for organizations utilizing Oracle E-Business Suite with HRMS (Norway) implementations. Successful exploitation could result in complete access to all data accessible through the vulnerable component, potentially exposing sensitive employee information, financial records, and business-critical personnel data. This level of access could enable attackers to conduct identity theft operations, perform insider trading activities, or engage in corporate espionage. The impact extends beyond simple data theft as the compromised system could serve as a foothold for further lateral movement within the enterprise network, potentially compromising additional systems and applications.
Organizations should implement immediate mitigations including applying the relevant Oracle security patches released to address this vulnerability. Network segmentation strategies should be implemented to limit access to the affected HRMS (Norway) component, while monitoring and logging mechanisms should be enhanced to detect unusual access patterns or unauthorized data queries. Access controls must be strictly enforced with principle of least privilege applied to all user accounts, particularly those with access to HRMS functionality. The vulnerability aligns with CWE-284 (Improper Access Control) and can be mapped to ATT&CK technique T1078 (Valid Accounts) and T1005 (Data from Local System), emphasizing the need for comprehensive security controls beyond simple patch management approaches. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities across the entire Oracle E-Business Suite implementation.