CVE-2026-61036 Overview
CVE-2026-61036 affects the Oracle HRMS (Norway) product within Oracle E-Business Suite, specifically the Norway Payroll component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle HRMS (Norway).
Successful exploitation results in unauthorized update, insert, or delete access to a subset of Oracle HRMS (Norway) data. Attackers also gain unauthorized read access to a subset of accessible data. Oracle addressed the issue in the Oracle Security Alert July 2026.
Critical Impact
Authenticated attackers with high privileges can modify and read Oracle HRMS (Norway) payroll data over the network, affecting confidentiality and integrity of HR records.
Affected Products
- Oracle E-Business Suite, Oracle HRMS (Norway), version 12.2.3
- Oracle E-Business Suite, Oracle HRMS (Norway), versions 12.2.4 through 12.2.14
- Oracle E-Business Suite, Oracle HRMS (Norway), version 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-61036 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle releases fix in the Oracle Security Alert July 2026
Technical Details for CVE-2026-61036
Vulnerability Analysis
The vulnerability resides in the Norway Payroll component of Oracle HRMS (Norway), a module of Oracle E-Business Suite used to process payroll data for Norwegian jurisdictions. Oracle classifies the issue as a broken access control flaw affecting authenticated sessions.
An attacker who already holds high privileges within the application can send crafted HTTP requests to the affected endpoints. The application fails to correctly enforce authorization boundaries, allowing the attacker to reach data operations they should not be permitted to perform. The impact is scoped to a subset of Oracle HRMS (Norway) data rather than the entire application dataset.
Exploitation does not require user interaction and the attack complexity is low. The EPSS probability for exploitation is 0.257% with a percentile of 17.334, indicating a low near-term likelihood of exploitation activity.
Root Cause
The root cause is improper access control within the Norway Payroll component. The application does not adequately validate whether the authenticated principal is authorized to perform the requested read or write operation against specific payroll records. Oracle has not published detailed technical root-cause information beyond the advisory summary.
Attack Vector
The attack vector is network-based over HTTP. An attacker must first authenticate with high privileges to the Oracle E-Business Suite instance. After authentication, the attacker issues HTTP requests to Norway Payroll endpoints to insert, update, delete, or read data outside their intended authorization scope. No user interaction is required and the scope is unchanged.
Refer to the Oracle Security Alert July 2026 for vendor guidance and patch metadata.
Detection Methods for CVE-2026-61036
Indicators of Compromise
- Unexpected INSERT, UPDATE, or DELETE operations against Norway Payroll tables from user accounts that do not routinely modify payroll data
- HTTP request patterns targeting Norway Payroll endpoints from privileged application accounts outside normal business hours
- Audit log entries showing high-privileged users accessing payroll records for employees outside their assigned scope
Detection Strategies
- Enable Oracle E-Business Suite auditing (FND_LOGIN_AUDIT, sign-on audit) on privileged responsibilities associated with HRMS and payroll functions
- Correlate application-level audit records with database-level fine-grained auditing on payroll tables to identify unauthorized data changes
- Baseline normal HTTP traffic volume and endpoint usage for Norway Payroll modules, then alert on statistical deviations
Monitoring Recommendations
- Monitor privileged EBS user sessions for anomalous access to Norway Payroll URIs and forms
- Forward Oracle EBS access logs, concurrent request logs, and database audit logs to a centralized SIEM for correlation
- Review Oracle Critical Patch Update compliance reports to confirm affected instances have received the July 2026 fix
How to Mitigate CVE-2026-61036
Immediate Actions Required
- Apply the patch bundle referenced in the Oracle Security Alert July 2026 to all Oracle E-Business Suite instances running Oracle HRMS (Norway) versions 12.2.3 through 12.2.15
- Inventory user accounts holding HRMS (Norway) and Norway Payroll responsibilities and reduce membership to the minimum required
- Rotate credentials for privileged application accounts if patch application must be delayed
Patch Information
Oracle released the fix as part of the Oracle Security Alert July 2026. Administrators should download the applicable patch for their Oracle E-Business Suite 12.2.x version and apply it following Oracle's standard EBS patching procedure. See the Oracle Security Alert July 2026 for patch identifiers and prerequisites.
Workarounds
- Restrict HTTP access to Oracle E-Business Suite HRMS (Norway) endpoints to trusted internal network segments using firewall or reverse proxy rules
- Remove Norway Payroll responsibilities from user accounts that do not require them until the patch is applied
- Enable enhanced auditing on payroll tables and responsibilities to detect exploitation attempts during the remediation window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
