This vulnerability affects Oracle HRMS (US) versions 12.2.3 through 12.2.15 and is classified under CVE-2026-62565. It is an easily exploitable flaw that permits a low privileged attacker with network access via HTTP to compromise the Oracle HRMS (US) system. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle HRMS (US). Additionally, the attacker may gain unauthorized capabilities to update, insert, or delete some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for it. Customers are urged to apply Oracle's cumulative patches promptly to mitigate this and other vulnerabilities.

The vulnerability allows unauthorized access to critical and potentially all accessible data within Oracle HRMS (US). It also permits unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or data manipulation. There is no direct impact on availability reported.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple security vulnerabilities, including this one. Although no specific patch link for CVE-2026-62565 is provided, customers should apply the July 2026 Critical Patch Update promptly to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is not explicitly confirmed for this CVE alone; therefore, check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions.