This vulnerability affects Oracle HRMS (UK) versions 12.2.9 through 12.2.15 within the Oracle E-Business Suite, specifically the UK Payroll component. It is exploitable over the network via HTTP by an attacker with low privileges and does not require user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle HRMS (UK). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability. Oracle recommends applying patches from the Critical Patch Update without delay.

The vulnerability enables an attacker with low privileges and network access via HTTP to gain unauthorized capabilities to create, delete, or modify critical data within Oracle HRMS (UK). This compromises the confidentiality and integrity of sensitive payroll and HR data. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple vulnerabilities and strongly recommends customers apply these patches promptly. Although the advisory does not explicitly confirm a patch for CVE-2026-61122, customers should review the advisory and apply all relevant patches for Oracle HRMS (UK) versions 12.2.9 through 12.2.15 as soon as possible. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the vendor advisory for the latest remediation guidance.