This vulnerability affects Oracle HRMS (US) versions 12.2.7 through 12.2.15 and allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely without authentication or user interaction, with low attack complexity and high confidentiality impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch or remediation for this vulnerability. The vendor strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation leads to unauthorized access to critical or all data accessible by Oracle HRMS (US), compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication or user interaction, making it a significant risk for data breaches in affected environments.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch or remediation level for CVE-2026-62521. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively-supported versions and apply security patches without delay once available. Until an official patch is confirmed, restrict network access to Oracle HRMS (US) HTTP interfaces to trusted users only and monitor for unusual access patterns.