This vulnerability affects Oracle HRMS (US) versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle HRMS (US) and unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch or remediation status for this vulnerability. Customers are strongly advised to review Oracle's advisory and apply patches promptly if available.

The vulnerability enables unauthorized access to critical or all data accessible by Oracle HRMS (US) and allows unauthorized data modification actions such as update, insert, or delete. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the specific patch or remediation status for CVE-2026-62565 is not explicitly confirmed in the advisory content provided. Organizations should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches without delay. Until a patch is applied, limit network exposure of Oracle HRMS (US) systems and restrict access to trusted users only.