Description
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is situated in the Oracle HRMS (US) module of Oracle E‑Business Suite, specifically affecting the US Payroll – General component. It permits an unauthenticated attacker who can reach the system over the network via HTTP to bypass the access‑control mechanism, which is a CWE‑284 weakness. This flaw enables the attacker to read any data exposed by the HR system, creating a pure confidentiality breach without altering data integrity or disrupting service availability.

Affected Systems

The affected product is Oracle HRMS (US) from Oracle Corporation, supported version range 12.2.7 through 12.2.15.

Risk and Exploitability

The likely attack vector is network access via HTTP, inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N). The CVSS 3.1 base score of 7.5 reflects low complexity, no privilege, no user interaction and a confidentiality‑only impact. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation provides an attacker with full read access to all Oracle HRMS (US) data, making the risk significant for organizations that rely on this product.

Generated by OpenCVE AI on August 4, 2026 at 00:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle HRMS patch or update that addresses CVE-2026-62521 as referenced in the Oracle advisory
  • Configure network firewalls or reverse proxies to block unauthenticated HTTP traffic to the HRMS (US) endpoints
  • Implement access controls or authentication mechanisms to restrict HTTP access to authorized users only
  • Monitor logs for suspicious HTTP requests targeting HRMS services and conduct periodic security audits

Generated by OpenCVE AI on August 4, 2026 at 00:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Oracle HRMS HTTP Exploit

Sun, 02 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Oracle HRMS HTTP Exploit

Thu, 30 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Exploitation in Oracle HRMS (US) Leading to Data Breach

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Exploitation in Oracle HRMS (US) Leading to Data Breach

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T15:17:13.644Z

Reserved: 2026-07-14T14:54:48.738Z

Link: CVE-2026-62521

cve-icon Vulnrichment

Updated: 2026-07-22T15:16:56.447Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:45:03Z

Weaknesses