Threat Intelligence Database

CVE-2026-62567 is a high-severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. While the flaw is in Oracle HRMS (UK), exploitation may impact additional Oracle products. No explicit patch or remediation level is confirmed in the vendor advisory as of the published date. Oracle recommends applying security patches promptly and staying on supported versions. The vendor advisory does not specifically mention a patch for this vulnerability in the July 2026 Critical Patch Update, so patch status is not yet confirmed.

CVE-2026-62557 is a high-severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all data accessible by Oracle HRMS (UK). The attacker can also perform unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating significant confidentiality and integrity impacts without availability impact.

CVE-2026-62549 is a critical vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability also has scope to impact additional Oracle products. The CVSS 3.1 base score is 9.6, indicating high confidentiality and integrity impact without availability impact. No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle strongly recommends applying security patches promptly. The vendor advisory references a Critical Patch Update released in July 2026 covering many vulnerabilities, but does not specifically confirm a patch for this CVE. No known exploits in the wild have been reported yet.

CVE-2026-62456 is a high-severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTPS to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability also has a scope change impact, affecting additional Oracle products. The CVSS 3.1 base score is 8.2, reflecting high confidentiality and integrity impacts. No official patch or remediation level is currently confirmed by Oracle. The vendor strongly recommends applying security patches promptly as part of their Critical Patch Update process. No known exploits in the wild have been reported to date.

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HRMS (UK). CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVE-2026-61122 is a high-severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.9 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data or all accessible data within Oracle HRMS (UK). The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity without affecting availability. No official patch or remediation level has been confirmed yet by Oracle. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability. Customers are advised to monitor Oracle advisories and apply patches promptly once available.

CVE-2026-61121 is a high-severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite, specifically affecting UK Payroll versions 12.2.8 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, but no explicit patch or remediation details for this specific issue are confirmed in the advisory content. No known exploits in the wild have been reported yet.

CVE-2026-61117 is a vulnerability in Oracle HRMS (UK) versions 12.2.8 through 12.2.15 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation is difficult but can lead to unauthorized access to critical or all accessible data within Oracle HRMS (UK). The vulnerability also has potential impact on additional Oracle products. The CVSS 3.1 base score is 6.3, indicating medium severity with high confidentiality impact but no integrity or availability impact. No official patch or remediation level is currently confirmed from the vendor advisory.