This vulnerability affects Oracle HRMS (France) versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data, including the ability to create, delete, or modify such data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that the attack can be performed remotely with low complexity and privileges, no user interaction, and results in high confidentiality and integrity impact. The vendor advisory from Oracle does not explicitly confirm a patch for this specific vulnerability but advises applying the July 2026 Critical Patch Update, which includes numerous security fixes across Oracle products. Customers are urged to remain on supported versions and apply patches without delay to mitigate this and other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle HRMS (France), as well as unauthorized access to all accessible data in the product. This compromises confidentiality and integrity of sensitive HR data, potentially affecting business operations and data privacy. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle's July 2026 Critical Patch Update advisory recommends applying the provided security patches promptly to address this and other vulnerabilities. Although the advisory does not explicitly confirm a patch specifically for CVE-2026-62530, customers should apply the latest Critical Patch Update for Oracle E-Business Suite, including Oracle HRMS (France). Oracle strongly advises remaining on actively supported versions and applying security patches without delay. Patch status is not yet confirmed explicitly for this CVE; therefore, check the vendor advisory for current remediation guidance.