Threat Intelligence Database

CVE-2026-62565 is a high-severity vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all accessible data in Oracle HRMS (US). The attacker can also perform unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating significant confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory for July 2026 addressing multiple vulnerabilities, including this one, but no explicit patch link or remediation details for this specific issue are provided in the advisory content.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVE-2026-62561 is a high-severity vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where Oracle HRMS executes to compromise the application, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly. No explicit patch or remediation level is stated for this specific vulnerability in the advisory content provided.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). While the vulnerability is in Oracle HRMS (US), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVE-2026-62548 is a high-severity vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.2. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, but no explicit patch for this specific issue is confirmed in the advisory.

CVE-2026-62521 is a high-severity vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.7 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (US). The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, but no explicit patch or remediation level is confirmed for this specific issue in the advisory content provided.

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle HRMS (US) as well as unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data and unauthorized read access to a subset of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).

CVE-2026-61123 is a vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data and cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2. No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle recommends applying Critical Patch Updates promptly.

CVE-2026-61120 is a high-severity vulnerability in Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where Oracle HRMS executes to potentially compromise and take over the Oracle HRMS system. The vulnerability has a CVSS 3.1 base score of 7.0, indicating high impact on confidentiality, integrity, and availability. No explicit patch or remediation level is provided in the advisory, but Oracle's Critical Patch Update for July 2026 includes multiple security patches and recommends applying updates promptly. There are no known exploits in the wild at this time.