This vulnerability affects Oracle HRMS (UK) versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the system by unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector with low privileges required and no user interaction needed. The vulnerability impacts confidentiality and integrity but not availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to review the advisory and apply relevant patches promptly.

Successful exploitation allows unauthorized read access to some data and unauthorized modification (update, insert, delete) of some accessible data within Oracle HRMS (UK). This compromises confidentiality and integrity of affected data. There is no impact on availability. The attacker requires network access via HTTP and low privileges, with no user interaction needed.

Oracle has released a Critical Patch Update in July 2026 covering multiple vulnerabilities. However, the vendor advisory does not explicitly confirm a patch for CVE-2026-61260. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle HRMS (UK) HTTP interfaces to trusted users only.