This vulnerability affects Oracle HRMS (UK) versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. The attack can result in unauthorized access to critical or all data accessible by Oracle HRMS (UK). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability also has potential scope change effects impacting additional Oracle products. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one, but no explicit patch or remediation details for this specific CVE are provided in the advisory content.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by Oracle HRMS (UK). The confidentiality of sensitive information is severely impacted. There is no reported impact on integrity or availability. The vulnerability may also affect other Oracle products due to scope change, potentially broadening the impact beyond Oracle HRMS (UK).

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple security vulnerabilities across Oracle products. However, the advisory does not explicitly confirm the availability of a patch or fix for CVE-2026-62567. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed, organizations should apply any recommended mitigations from Oracle and maintain updated security practices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.