Description
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an attacker with high privileges and network access via HTTP to compromise Oracle HRMS (US). An attacker can elevate privileges, which can result in full control of the HRMS application and its data, compromising confidentiality, integrity, and availability of the system.

Affected Systems

The affected product is Oracle HRMS (US) in Oracle E-Business Suite, specifically internal operations components. Versions 12.2.3 through 12.2.15 are impacted.

Risk and Exploitability

The CVSS 3.1 score of 7.2 indicates a high severity rating. The EPSS score of < 1% suggests a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based via HTTP, requiring high privileged access within the network. If exploited successfully, the attacker could take over the HRMS (US) application and its underlying data.

Generated by OpenCVE AI on August 4, 2026 at 00:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle E-Business Suite patch for HRMS (US) as released in the Oracle CPU Jul 2026 advisory.
  • Limit HTTP access to the HRMS (US) interfaces to trusted network segments or IP addresses through firewall rules.
  • Monitor and audit HRMS privileged activity logs for anomalous behavior and review role-based access controls to enforce least privilege.

Generated by OpenCVE AI on August 4, 2026 at 00:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via High Privileged HTTP Access to Oracle HRMS (US)

Thu, 30 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via High Privileged HTTP Access to Oracle HRMS (US)

Tue, 28 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title High Privilege Escalation via HTTP in Oracle HRMS (US)

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title High Privilege Escalation via HTTP in Oracle HRMS (US)

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T13:22:10.601Z

Reserved: 2026-07-14T14:54:48.740Z

Link: CVE-2026-62548

cve-icon Vulnrichment

Updated: 2026-07-22T13:22:05.520Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:45:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management