This vulnerability affects Oracle HRMS (US) versions 12.2.6 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm the patch availability or remediation status for this specific vulnerability. Customers are strongly advised to apply Oracle's security patches promptly as per the advisory.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle HRMS (US). The confidentiality impact is high, but there is no impact on integrity or availability. This could compromise sensitive information managed by Oracle HRMS (US) in affected versions.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities. Although the specific patch for CVE-2026-62556 is not explicitly confirmed, Oracle recommends applying all relevant security patches without delay. Customers should verify patch availability and installation instructions in the referenced advisory: https://www.oracle.com/security-alerts/cpujul2026.html. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the vendor advisory for current remediation guidance.