CVE-2026-62567 is a vulnerability in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite affecting versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP and can lead to unauthorized access to critical or all accessible data in Oracle HRMS (UK). The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also affect additional Oracle products beyond HRMS (UK). The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible through Oracle HRMS (UK). The confidentiality impact is high, but integrity and availability are not affected. The vulnerability can be exploited remotely over the network by an attacker with low privileges and no user interaction is required. The scope of impact may extend beyond Oracle HRMS (UK) to other Oracle products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory does not explicitly list a patch for this vulnerability. Oracle strongly recommends customers remain on actively supported versions and apply security patches without delay once available. Until a patch is confirmed, restrict network access to Oracle HRMS (UK) HTTP interfaces to trusted users and monitor for unusual access patterns. Follow Oracle's official security advisories for updates on patch availability.