CVE-2026-61117: Oracle HRMS (UK) Information Disclosure Flaw

CVE-2026-61117 Overview

CVE-2026-61117 is an information disclosure vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.8 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this flaw, though exploitation is rated as difficult. Successful attacks can result in unauthorized access to critical Oracle HRMS (UK) data. Because the vulnerability involves a scope change, attacks may significantly impact additional Oracle products beyond HRMS (UK) itself. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data, with potential impact extending to additional Oracle products due to scope change.

Affected Products

Oracle E-Business Suite - Oracle HRMS (UK) 12.2.8
Oracle E-Business Suite - Oracle HRMS (UK) 12.2.9 through 12.2.14
Oracle E-Business Suite - Oracle HRMS (UK) 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-61117 published to NVD
2026-07-21 - Last updated in NVD database
Oracle disclosed the issue as part of the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61117

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle HRMS (UK), part of the Oracle E-Business Suite. An authenticated attacker with low privileges can send crafted HTTP requests to interact with the vulnerable component. Exploitation is classified as difficult, indicating that specialized conditions or timing are required to reliably trigger the flaw.

Only the confidentiality of data is impacted. Integrity and availability are not directly affected. However, the scope change indicator shows that a successful attack breaks out of the security context of Oracle HRMS (UK) and can affect resources managed by other Oracle products in the deployment.

Human resources data typically includes employee personal information, payroll data, and organizational structure. Unauthorized disclosure carries regulatory implications under UK GDPR and the Data Protection Act 2018.

Root Cause

Oracle has not published detailed root cause information. The advisory in the July 2026 Critical Patch Update indicates the flaw resides in server-side handling of HTTP-based requests within the Internal Operations component of Oracle HRMS (UK). Based on the CVSS profile, the defect enables an authenticated low-privileged user to read data outside the intended authorization boundary.

Attack Vector

The attack requires network access via HTTP and valid low-privileged credentials to the Oracle E-Business Suite environment. No user interaction is required. The attacker sends crafted requests to the Internal Operations component. Because the vulnerability alters trust scope, the returned data may include records governed by adjacent Oracle products integrated with HRMS (UK).

No public proof-of-concept, exploit code, or exploitation-in-the-wild reports are available at the time of publication. Detailed exploitation mechanics have not been disclosed by Oracle. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor guidance.

Detection Methods for CVE-2026-61117

Indicators of Compromise

Unexpected HTTP requests from low-privileged Oracle E-Business Suite user accounts targeting Internal Operations endpoints of the HRMS (UK) module.
Large or repeated data reads against HRMS (UK) resources not associated with the user's job role.
Anomalous cross-module data retrieval patterns that correlate HRMS (UK) sessions with data from other Oracle E-Business Suite components.

Detection Strategies

Enable Oracle E-Business Suite audit logging on HRMS (UK) modules and forward records to a centralized log platform for correlation.
Baseline normal usage patterns for the Internal Operations component and alert on deviations by low-privileged accounts.
Inspect HTTP access logs on Oracle Application Server for unusual query parameters or repeated access to sensitive HRMS URLs.

Monitoring Recommendations

Monitor authenticated sessions for unusual query volume against HRMS (UK) endpoints, especially outside business hours.
Track privilege usage and role assignments in Oracle E-Business Suite to detect abuse of low-privileged accounts.
Alert on any HRMS (UK) responses that reference data owned by other Oracle E-Business Suite modules, which may indicate scope-change exploitation.

How to Mitigate CVE-2026-61117

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running HRMS (UK) versions 12.2.8 through 12.2.15.
Inventory all Oracle E-Business Suite deployments and confirm patch status against the vendor advisory.
Review Oracle E-Business Suite user accounts and remove or downgrade unused low-privileged accounts that could serve as an entry point.

Patch Information

Oracle released fixes for CVE-2026-61117 in the Oracle Critical Patch Update July 2026. Administrators should apply the vendor-supplied patches to affected 12.2.8-12.2.15 deployments. No official workaround has been published by Oracle, and patching is the recommended remediation.

Workarounds

Restrict HTTP access to Oracle E-Business Suite Internal Operations endpoints using network segmentation and web application firewall rules until patches are applied.
Enforce strong authentication and continuous session validation for all Oracle E-Business Suite users to reduce the pool of accounts an attacker can leverage.
Increase audit logging verbosity on HRMS (UK) modules to support post-incident forensic review while remediation is in progress.

bash

# Configuration example: enable enhanced audit on Oracle E-Business Suite HRMS module
# Set FND profile options to capture HRMS activity, then apply the July 2026 CPU
sqlplus apps/<password> <<EOF
EXEC FND_PROFILE.SAVE('SIGNON_AUDIT_LEVEL', 'FORM', 'SITE');
EXEC FND_PROFILE.SAVE('AUDITTRAIL:ACTIVATE', 'Y', 'SITE');
COMMIT;
EXIT;
EOF

# After enabling auditing, apply the Oracle Critical Patch Update July 2026
# following the README bundled with the patch archive