This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data and causing partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vulnerability is publicly known and assigned CVE-2026-61119. Oracle's July 2026 Critical Patch Update advisory references a large set of patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized modification of critical data within Oracle HRMS (UK) and partial denial of service, impacting data integrity and system availability. Confidentiality is not affected according to the CVSS vector. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities. However, the vendor advisory does not explicitly confirm patch availability or remediation status for CVE-2026-61119. Customers should review the July 2026 Critical Patch Update advisory and apply relevant patches promptly if available. Until patch status is confirmed, monitor Oracle's official security advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.