Description
Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker with low privileges and network access through HTTP to compromise the Oracle HRMS (France) product of Oracle E-Business Suite. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or the ability to read all data accessible through the HRMS. This issue stems from an improper access control weakness (CWE-284) and compromises confidentiality and integrity.

Affected Systems

Affected versions are Oracle HRMS (France) in Oracle E-Business Suite from 12.2.3 through 12.2.15. No other products are listed.

Risk and Exploitability

The CVSS 3.1 base score is 8.1, with confidentiality and integrity impacts. The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be able to reach the HRMS over HTTP and possess low‑privilege accounts. Given the high severity and the requirement for network proximity, the overall risk is significant but the likelihood of widespread exploitation remains low.

Generated by OpenCVE AI on August 4, 2026 at 00:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Consult Oracle's security advisories for available fixes or updates.
  • Control network access to the HRMS system by restricting HTTP traffic to known administrators, using a firewall or VPN to limit exposure.
  • Enforce the principle of least privilege for all user accounts interacting with the HRMS, removing unnecessary permissions to reduce potential impact.

Generated by OpenCVE AI on August 4, 2026 at 00:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Easily exploitable low privileged access control vulnerability in Oracle HRMS (France)

Thu, 30 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Modification of Oracle HRMS (France) via Low‑Privilege HTTP Attack

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Modification of Oracle HRMS (France) via Low‑Privilege HTTP Attack

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T13:54:21.846Z

Reserved: 2026-07-14T14:54:48.739Z

Link: CVE-2026-62530

cve-icon Vulnrichment

Updated: 2026-07-22T13:54:08.439Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:45:03Z

Weaknesses