CVE-2026-62549 is a vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically in the UK Payroll component. It affects supported versions 12.2.3 through 12.2.15. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP, allowing compromise of Oracle HRMS (UK). Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle HRMS (UK). The vulnerability has a CVSS 3.1 base score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality and integrity impact, and no availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) mentions a large number of patches but does not explicitly confirm a patch for this vulnerability. Oracle recommends applying security patches promptly to mitigate risks.

The vulnerability allows an attacker with low privileges and network access via HTTP to compromise Oracle HRMS (UK). This can result in unauthorized creation, deletion, or modification of critical data, or full unauthorized access to all data accessible by Oracle HRMS (UK). The impact affects confidentiality and integrity severely, with no direct availability impact. The vulnerability also has scope to affect additional Oracle products beyond Oracle HRMS (UK).

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities. However, the vendor advisory does not explicitly confirm a patch for CVE-2026-62549. Customers are strongly advised to remain on actively supported versions and apply all available security patches without delay. Patch status for this specific vulnerability is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.