PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61251 Oracle Corporation CVE debrief

A vulnerability was discovered in the HRMS (Australia) product of Oracle E-Business Suite, specifically in the Payroll component. The affected versions are 12.2.3-12.2.15. This medium-severity issue has a CVSS 3.1 Base Score of 6.5, primarily impacting confidentiality. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise HRMS (Australia), potentially leading to unauthorized access to critical data or complete access to all HRMS (Australia) accessible data.

Vendor
Oracle Corporation
Product
HRMS (Australia)
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Organizations using Oracle E-Business Suite, specifically HRMS (Australia) versions 12.2.3-12.2.15, should prioritize patching this vulnerability. IT administrators, cybersecurity teams, and risk management professionals responsible for Oracle E-Business Suite deployments should be aware of this issue and take appropriate action.

Technical summary

The vulnerability in Oracle E-Business Suite's HRMS (Australia) product, specifically in the Payroll component, has been identified. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is described as easily exploitable, allowing a low-privileged attacker with network access via HTTP to compromise HRMS (Australia). Successful attacks could result in unauthorized access to critical data or complete access to all HRMS (Australia) accessible data.

Defensive priority

Apply patches or updates provided by Oracle to address the vulnerability in HRMS (Australia). Review and update access controls to ensure that only authorized personnel have access to sensitive data and systems. Monitor for suspicious activity related to HRMS (Australia) and Oracle E-Business Suite.

Recommended defensive actions

  • Apply patches or updates provided by Oracle to address the vulnerability in HRMS (Australia).
  • Review and update access controls to ensure that only authorized personnel have access to sensitive data and systems.
  • Monitor for suspicious activity related to HRMS (Australia) and Oracle E-Business Suite.
  • Conduct a thorough review of Oracle E-Business Suite configurations to identify and mitigate potential risks.
  • Implement additional security measures, such as network segmentation or intrusion detection systems, to protect sensitive data.

Evidence notes

The CVE record was published on 2026-07-21T22:18:55.787Z and was last modified on 2026-07-22T20:17:07.013Z. The NVD entry is currently in the 'Received' status. Oracle has provided a security alert for this issue (reference: https://www.oracle.com/security-alerts/cpujul2026.html).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-61251 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-61251

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-61251 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61251

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.