This vulnerability affects Oracle HRMS (New Zealand) versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to certain accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisory references a large Critical Patch Update released in July 2026 but does not explicitly detail patch availability for this CVE. Patch status is therefore not confirmed and should be verified against Oracle's official advisory.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle HRMS (New Zealand). This compromises data confidentiality and integrity but does not affect availability. The attacker requires only low privileges and network access via HTTP, making the vulnerability relatively easy to exploit.

Oracle has released a Critical Patch Update in July 2026 covering numerous vulnerabilities. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-61255. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle HRMS (New Zealand) systems and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.