CVE-2026-61121 is a vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, affecting the UK Payroll component in versions 12.2.8 through 12.2.15. The vulnerability allows a low privileged attacker with network access over HTTP to compromise the Oracle HRMS (UK) system, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack can be performed remotely with low attack complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability at a high level. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions a large number of patches but does not explicitly confirm a patch or remediation level for this vulnerability. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate known vulnerabilities.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle HRMS (UK), impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle HRMS (UK) instance, potentially leading to unauthorized access to sensitive payroll and HR data, modification or deletion of data, and disruption of service.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch or remediation for CVE-2026-61121. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches without delay. Until a specific patch is confirmed, monitor Oracle's advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.