CVE-2026-62567
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle HRMS (UK) component of the Oracle E-Business Suite, specifically targeting the UK Payroll functionality. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this flaw has persisted across multiple maintenance cycles. The vulnerability's classification as easily exploitable means that an attacker with minimal privileges and network access via HTTP can successfully compromise the system without requiring specialized tools or extensive reconnaissance. This represents a significant security risk given that HRMS (UK) contains sensitive personnel and payroll data that organizations consider critical.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the UK Payroll component, allowing low privileged users to bypass normal security restrictions. The CVSS 3.1 base score of 7.7 indicates a high severity level with confidentiality impacts being the primary concern. The attack vector AV:N (Network) suggests that exploitation can occur remotely without requiring physical access to the system. The AC:L (Low Attack Complexity) and PR:L (Low Privilege Required) ratings indicate that even relatively unsophisticated attackers can leverage this vulnerability successfully, while UI:N (No User Interaction Required) means the attack can be automated without user participation.
The operational impact extends beyond the immediate HRMS (UK) component due to the scope change designation mentioned in the vulnerability description. This suggests that successful exploitation may allow attackers to access data or functionality within other Oracle products that interface with or depend on the compromised HRMS (UK) system. The potential for unauthorized access to critical data represents a severe business impact, particularly given that payroll and personnel information constitutes highly sensitive organizational data. Complete access to all Oracle HRMS (UK) accessible data means attackers could potentially view, modify, or exfiltrate employee records, salary information, benefits data, and other confidential personnel details.
This vulnerability aligns with CWE-284 (Improper Access Control) and relates to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing), as it allows unauthorized access through legitimate network channels. Organizations should implement immediate mitigations including applying the latest security patches from Oracle, implementing network segmentation to limit access to HRMS (UK) components, and conducting thorough access control reviews to ensure least privilege principles are maintained. Additionally, monitoring network traffic for suspicious HTTP requests targeting payroll functionality can help detect exploitation attempts, while regular vulnerability assessments should be conducted to identify similar access control weaknesses across the broader Oracle E-Business Suite deployment.