This vulnerability affects Oracle HRMS (US) versions 12.2.7 through 12.2.15 and allows unauthenticated remote attackers to access sensitive data over HTTP without needing privileges or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which includes 1449 security patches across multiple Oracle products. However, the advisory does not explicitly confirm a patch or remediation status for this specific CVE. Oracle recommends customers remain on supported versions and apply patches without delay to protect against exploitation.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle HRMS (US), compromising confidentiality. There is no impact on integrity or availability. The vulnerability is exploitable remotely over HTTP without authentication, increasing risk.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and recommends applying them promptly. However, the advisory does not explicitly confirm a patch for CVE-2026-62521. Therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Customers should ensure they apply all relevant Critical Patch Updates from Oracle and remain on actively supported versions to mitigate this vulnerability.