CVE-2026-61123: Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (US) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (US). in Oracle Corporation Oracle HRMS (US)
CVE-2026-61123 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2. No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle recommends applying Critical Patch Updates promptly.
AI Analysis
Technical Summary
This vulnerability affects Oracle HRMS (US) versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of accessible data and the ability to cause a partial denial of service. The attack vector requires network access via HTTP and low privileges, with a high attack complexity. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L, indicating limited confidentiality and availability impacts without integrity impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for Oracle HRMS (US).
Potential Impact
Successful exploitation can lead to unauthorized disclosure of some Oracle HRMS (US) data and partial denial of service conditions. The impact on confidentiality is limited, and there is no integrity impact. Availability impact is partial, meaning some service disruption may occur but not a full outage.
Mitigation Recommendations
Oracle's advisory strongly recommends applying Critical Patch Updates without delay to address vulnerabilities. However, the vendor advisory does not explicitly confirm a patch or remediation for this specific vulnerability at this time. Therefore, patch status is not yet confirmed — check the Oracle Critical Patch Update advisory for current remediation guidance. No specific mitigations or workarounds are detailed in the advisory.
CVE-2026-61123: Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (US) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (US). in Oracle Corporation Oracle HRMS (US)
Description
CVE-2026-61123 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2. No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle recommends applying Critical Patch Updates promptly.
CVSS v3.1
Score 4.2medium
Affected software
pkg:maven/com.oracle/Oracle-HRMS-USRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle HRMS (US) versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of accessible data and the ability to cause a partial denial of service. The attack vector requires network access via HTTP and low privileges, with a high attack complexity. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L, indicating limited confidentiality and availability impacts without integrity impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for Oracle HRMS (US).
Potential Impact
Successful exploitation can lead to unauthorized disclosure of some Oracle HRMS (US) data and partial denial of service conditions. The impact on confidentiality is limited, and there is no integrity impact. Availability impact is partial, meaning some service disruption may occur but not a full outage.
Mitigation Recommendations
Oracle's advisory strongly recommends applying Critical Patch Updates without delay to address vulnerabilities. However, the vendor advisory does not explicitly confirm a patch or remediation for this specific vulnerability at this time. Therefore, patch status is not yet confirmed — check the Oracle Critical Patch Update advisory for current remediation guidance. No specific mitigations or workarounds are detailed in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.614Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee2f9c2644c7f8d5d333
Added to database: 07/21/2026, 22:09:51 UTC
Last enriched: 07/30/2026, 04:05:10 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.