PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61075 Oracle CVE debrief

A vulnerability was discovered in Oracle Self-Service Human Resources, a component of Oracle E-Business Suite. The vulnerability is easily exploitable, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Self-Service Human Resources.

Vendor
Oracle
Product
Self-Service Human Resources
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Administrators and users of Oracle Self-Service Human Resources, particularly those with low-privileged access, should be aware of this vulnerability and take necessary precautions. Operators, platform administrators, and security teams should review the vulnerability and implement necessary mitigations.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 5.4, with Confidentiality and Integrity impacts. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The affected versions of Oracle Self-Service Human Resources are 12.2.3-12.2.15. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

Defensive priority

Medium priority should be given to patching this vulnerability, as it can be exploited by low-privileged attackers with network access.

Recommended defensive actions

  • Apply the patch provided by Oracle as soon as possible
  • Review and update access controls to limit low-privileged access
  • Monitor system logs for suspicious activity
  • Consider implementing additional security measures, such as network segmentation or intrusion detection
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:18:38.303Z and last modified on 2026-07-27T16:58:47.197Z. The NVD entry is currently Analyzed. The vulnerability affects Oracle Self-Service Human Resources, a component of Oracle E-Business Suite, with versions 12.2.3-12.2.15 being vulnerable. The CVE details are based on the official CVE record and NVD entry. Defenders should verify the affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-61075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-61075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-61075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.