CVE-2026-46953: Oracle HRMS Privilege Escalation Flaw

CVE-2026-46953 Overview

CVE-2026-46953 is a high-severity vulnerability in the Oracle Human Resources Management System (HRMS) UK product, part of Oracle E-Business Suite. The flaw resides in the UK Payroll component and affects supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access via HTTP can exploit the issue to fully compromise Oracle HRMS (UK). Successful exploitation leads to takeover of the application, impacting confidentiality, integrity, and availability. The vulnerability is tracked under [CWE-269] Improper Privilege Management.

Critical Impact
Successful exploitation results in complete takeover of Oracle HRMS (UK), exposing payroll data and enabling unauthorized modification of HR records.

Affected Products

Oracle HRMS (UK) version 12.2.3
Oracle E-Business Suite versions 12.2.4 through 12.2.14
Oracle HRMS (UK) version 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46953 published to NVD
2026-06-18 - Last updated in NVD database
June 2026 - Addressed in Oracle Security Alert June 2026

Technical Details for CVE-2026-46953

Vulnerability Analysis

The vulnerability affects the UK Payroll component of Oracle HRMS (UK), shipped within Oracle E-Business Suite. An authenticated attacker holding high privileges can issue crafted HTTP requests to the application server and gain full control of the HRMS (UK) module. The attack does not require user interaction and operates within the same security scope as the targeted component.

The issue is classified as Improper Privilege Management [CWE-269]. This category covers flaws where privilege checks are inadequate, allowing an authenticated user to perform actions or access resources beyond their intended authorization. In this case, the post-authentication boundary between privileged HR administrators and full application control is not enforced correctly.

The EPSS probability is 0.43% as of 2026-06-18, placing the CVE in the 34th percentile for short-term exploitation likelihood. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of disclosure.

Root Cause

The root cause lies in insufficient privilege management within the UK Payroll component. Authorization checks do not adequately restrict privileged operations, allowing an attacker who already holds elevated application access to escalate to full takeover of the HRMS (UK) module.

Attack Vector

The attacker requires network access over HTTP to the Oracle E-Business Suite application server and must already possess high-privilege credentials within the HRMS application. From this position, the attacker sends crafted requests to the UK Payroll component to trigger the privilege handling flaw. Refer to the Oracle Security Alert June 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-46953

Indicators of Compromise

Unexpected privileged actions performed against the UK Payroll module by accounts that do not normally execute payroll administration workflows.
HTTP requests targeting UK Payroll endpoints originating from accounts that recently received elevated HRMS responsibilities.
Modifications to payroll configuration tables or user responsibility assignments outside scheduled change windows.

Detection Strategies

Audit Oracle E-Business Suite signed-on audit and Function Security logs for high-privileged HRMS users invoking UK Payroll functions outside their job role.
Correlate Oracle HTTP Server access logs with application user IDs to identify unusual request patterns against UK Payroll URIs.
Review changes to FND_USER, FND_RESPONSIBILITY, and HRMS security profiles for unauthorized grants of payroll responsibilities.

Monitoring Recommendations

Forward Oracle E-Business Suite audit logs, database listener logs, and Oracle HTTP Server logs to a centralized SIEM for correlation.
Establish baselines for privileged HRMS administrator activity and alert on deviations affecting UK Payroll functions.
Monitor for new or modified database accounts with APPS or HR-schema privileges that could be used to chain post-exploitation activity.

How to Mitigate CVE-2026-46953

Immediate Actions Required

Apply the patches from the Oracle Security Alert June 2026 to all Oracle E-Business Suite environments running HRMS (UK) versions 12.2.3 through 12.2.15.
Inventory all accounts holding high-privilege HRMS or UK Payroll responsibilities and revoke entitlements that are not strictly required.
Enforce multi-factor authentication for all administrative access to Oracle E-Business Suite.

Patch Information

Oracle released fixes for CVE-2026-46953 in the June 2026 Critical Patch Update. Administrators should download the relevant patch from My Oracle Support and apply it following the prerequisites outlined in the Oracle Security Alert June 2026. Confirm successful application by reviewing the AD_BUGS table and post-patch validation steps for the HRMS UK Payroll component.

Workarounds

Restrict network reachability of the Oracle E-Business Suite HTTP tier to trusted administrative networks until patching is complete.
Temporarily reduce the number of users assigned UK Payroll and HRMS super-user responsibilities to the minimum operational set.
Increase audit logging on privileged HRMS actions and review logs daily until the patch is deployed.

bash

# Verify patch application on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
FROM ad_bugs
WHERE bug_number = '<June 2026 CPU patch id>';
EXIT;
EOF