This vulnerability affects Oracle HRMS (US) versions 12.2.3 to 12.2.15 and allows an attacker with low privileges and logon access to the underlying infrastructure to compromise Oracle HRMS (US). The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and impacts confidentiality, integrity, and availability at a high level (C:H/I:H/A:H). The vulnerability can lead to a complete takeover of the Oracle HRMS (US) application. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this CVE. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation of this vulnerability can result in full compromise of Oracle HRMS (US), impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and logon access to the infrastructure can leverage this flaw to take over the Oracle HRMS (US) application, potentially leading to unauthorized data access, modification, or disruption of service.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across Oracle products. While the advisory includes Oracle HRMS (US), it does not explicitly confirm patch availability or remediation status for CVE-2026-62561. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Maintaining actively supported versions and timely patch application is strongly recommended to mitigate this vulnerability. Patch status is not yet confirmed for this specific CVE—check the vendor advisory for current remediation guidance.