PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61251 Oracle Corporation CVE debrief

A vulnerability was discovered in the HRMS (Australia) product of Oracle E-Business Suite, specifically in the Payroll component. The affected versions are 12.2.3-12.2.15. This medium-severity issue has a CVSS 3.1 Base Score of 6.5, primarily impacting confidentiality. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise HRMS (Australia), potentially leading to unauthorized access to critical data or complete access to all HRMS (Australia) accessible data.

Vendor
Oracle Corporation
Product
HRMS (Australia)
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Organizations using Oracle E-Business Suite, specifically HRMS (Australia) versions 12.2.3-12.2.15, should prioritize patching this vulnerability. IT administrators, cybersecurity teams, and risk management professionals responsible for Oracle E-Business Suite deployments should be aware of this issue and take appropriate action.

Technical summary

The vulnerability in Oracle E-Business Suite's HRMS (Australia) product, specifically in the Payroll component, has been identified. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is described as easily exploitable, allowing a low-privileged attacker with network access via HTTP to compromise HRMS (Australia). Successful attacks could result in unauthorized access to critical data or complete access to all HRMS (Australia) accessible data.

Defensive priority

Apply patches or updates provided by Oracle to address the vulnerability in HRMS (Australia). Review and update access controls to ensure that only authorized personnel have access to sensitive data and systems. Monitor for suspicious activity related to HRMS (Australia) and Oracle E-Business Suite.

Recommended defensive actions

  • Apply patches or updates provided by Oracle to address the vulnerability in HRMS (Australia).
  • Review and update access controls to ensure that only authorized personnel have access to sensitive data and systems.
  • Monitor for suspicious activity related to HRMS (Australia) and Oracle E-Business Suite.
  • Conduct a thorough review of Oracle E-Business Suite configurations to identify and mitigate potential risks.
  • Implement additional security measures, such as network segmentation or intrusion detection systems, to protect sensitive data.

Evidence notes

The CVE record was published on 2026-07-21T22:18:55.787Z and was last modified on 2026-07-22T20:17:07.013Z. The NVD entry is currently in the 'Received' status. Oracle has provided a security alert for this issue (reference: https://www.oracle.com/security-alerts/cpujul2026.html).

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:55.787Z and has not been modified since then. The NVD entry is currently Received.