This vulnerability affects Oracle HRMS (Hong Kong) versions 12.2.13 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system by gaining unauthorized update, insert, delete, and read access to some accessible data. The CVSS 3.1 base score is 5.4, reflecting low complexity and privileges required, with impacts on confidentiality and integrity but no impact on availability. The vendor advisory references a July 2026 Critical Patch Update containing many patches, but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to apply available patches promptly as per Oracle's general guidance.

Successful exploitation results in unauthorized read access to a subset of Oracle HRMS (Hong Kong) accessible data and unauthorized update, insert, or delete access to some data. This compromises data confidentiality and integrity but does not impact system availability. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities in Oracle products. However, the advisory does not explicitly confirm a patch for CVE-2026-61252. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle HRMS (Hong Kong) interfaces where possible and monitor for unusual activity related to data modification or access.