This vulnerability affects Oracle HRMS (UK) versions 12.2.8 through 12.2.15 within the Oracle E-Business Suite, specifically the UK Payroll component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling compromise and potential takeover of the Oracle HRMS system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are urged to apply patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete compromise of Oracle HRMS (UK), impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle HRMS environment, potentially leading to unauthorized access to sensitive payroll data and disruption of HRMS services.

Oracle has released its July 2026 Critical Patch Update advisory which includes numerous security patches. Although the advisory does not explicitly confirm a patch for CVE-2026-61121, customers should review the advisory and apply all relevant patches promptly to mitigate this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.