Description
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Norway) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-07-21
Score: 3.8 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability in the Norway Payroll component of Oracle HRMS allows a high‑privileged attacker with network access via HTTP to update, insert, or delete restricted payroll data and read a subset of data that should be protected. The flaw stemmed from insufficient access control for privileged operations, leading to confidentiality and integrity impacts as reflected by a CVSS score of 3.8.

Affected Systems

Oracle Corporation’s Oracle HRMS (Norway) payroll component, version numbers 12.2.3 through 12.2.15 inclusive, is affected. These releases are part of Oracle E‑Business Suite.

Risk and Exploitability

The CVSS 3.1 Base Score 3.8 indicates low severity, with low confidentiality and integrity impact. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the vulnerability is easily exploitable over HTTP, a high‑privileged remote attacker could gain unauthorized data modification or disclosure, yet the risk remains relatively contained. Oracle has not listed this issue in the CISA KEV catalog.

Generated by OpenCVE AI on August 4, 2026 at 02:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the latest Oracle HRMS patch that addresses the Norway Payroll component vulnerability.
  • Restrict HTTP access to the payroll service to trusted internal networks or VPN endpoints only, blocking public internet traffic.
  • Enforce least privilege by ensuring only accounts with necessary rights can perform data modification on payroll entries, and audit any privileged actions.
  • Monitor audit logs for anomalous data modification or read attempts and investigate any irregularities promptly.

Generated by OpenCVE AI on August 4, 2026 at 02:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Payroll Data Manipulation via Oracle HRMS (Norway) Vulnerability

Thu, 30 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Payroll Data Manipulation via Oracle HRMS (Norway) Vulnerability

Tue, 28 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Oracle HRMS Norway Payroll Access Control Flaw Allows Unauthorized Data Modification and Partial Disclosure

Fri, 24 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title Oracle HRMS Norway Payroll Access Control Flaw Allows Unauthorized Data Modification and Partial Disclosure

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Norway) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Hrms Human Resources Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:46:17.564Z

Reserved: 2026-07-08T15:51:55.609Z

Link: CVE-2026-61036

cve-icon Vulnrichment

Updated: 2026-07-24T14:46:12.365Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:34.720

Modified: 2026-07-24T18:34:22.920

Link: CVE-2026-61036

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:15:04Z

Weaknesses