CVE-2026-61120 affects Oracle HRMS (US) within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. The vulnerability is difficult to exploit and requires a low privileged attacker to have logon access to the infrastructure hosting Oracle HRMS. Successful exploitation can lead to full compromise and takeover of the Oracle HRMS system. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which addresses multiple security issues across Oracle products. The advisory urges customers to remain on supported versions and apply patches without delay but does not explicitly confirm a patch for this CVE. No known exploits in the wild have been reported at this time.

This vulnerability allows a low privileged attacker with logon access to the Oracle HRMS infrastructure to potentially take over the Oracle HRMS system. The impact includes full compromise affecting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access to sensitive HR data and disruption of HRMS operations.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since the vendor advisory does not explicitly confirm the patch status for this specific vulnerability, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities.