CVE-2026-61119: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-61119 Overview

CVE-2026-61119 affects the Oracle HRMS (UK) product within Oracle E-Business Suite, specifically the UK Payroll component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. An attacker with low privileges and network access via HTTP can exploit the flaw without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical Oracle HRMS (UK) data. It can also cause a partial denial of service against the application. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can tamper with UK Payroll data and degrade Oracle HRMS (UK) availability over the network.

Affected Products

Oracle E-Business Suite — Oracle HRMS (UK), version 12.2.3
Oracle E-Business Suite — Oracle HRMS (UK), versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (UK), version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61119 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61119

Vulnerability Analysis

The vulnerability resides in the UK Payroll component of the Oracle HRMS (UK) product. Oracle rates the flaw as easily exploitable over the network. An attacker needs only a low-privileged account to interact with the exposed HTTP interface. No user interaction is required to complete the attack. Successful exploitation compromises the integrity of payroll and HR data. The same code path also allows partial availability disruption of Oracle HRMS (UK). Confidentiality is not directly impacted according to the Oracle advisory. Oracle has not published detailed root-cause information for this CVE.

Root Cause

Oracle's advisory does not disclose the specific weakness class or affected code paths. Based on the impact profile — integrity write access combined with partial denial of service reachable from a low-privileged HTTP session — the issue is consistent with an authorization or input validation defect in a UK Payroll servlet or business function. Consult the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack originates from the network. An authenticated user with low privileges sends crafted HTTP requests to the Oracle E-Business Suite web tier hosting the UK Payroll component. The requests trigger unauthorized create, update, or delete operations on HRMS (UK) data or cause partial denial of service. Because no verified proof-of-concept exists publicly, defenders should treat any anomalous UK Payroll HTTP activity from non-payroll accounts as suspicious.

No verified public exploit code exists for CVE-2026-61119. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-61119

Indicators of Compromise

Unexpected create, update, or delete operations against UK Payroll tables from application accounts that do not normally perform payroll write actions.
HTTP requests targeting UK Payroll endpoints originating from low-privileged Oracle E-Business Suite users.
Partial availability degradation or timeouts affecting the HRMS (UK) module without a corresponding infrastructure event.

Detection Strategies

Enable and review Oracle E-Business Suite audit trails on HRMS (UK) tables and UK Payroll business functions.
Correlate web-tier access logs with database audit records to identify low-privileged users invoking payroll write operations.
Baseline normal UK Payroll transaction patterns and alert on deviations in volume, timing, or user role.

Monitoring Recommendations

Forward Oracle E-Business Suite application, web-tier, and database audit logs to a centralized analytics platform.
Monitor authentication events for Oracle E-Business Suite accounts with access to HRMS (UK), especially anomalous logins outside payroll cycles.
Track HTTP error rates and response times for HRMS (UK) endpoints to detect partial denial-of-service conditions.

How to Mitigate CVE-2026-61119

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.3 through 12.2.15.
Review recent UK Payroll audit records for unauthorized data modifications prior to patching.
Restrict Oracle E-Business Suite web-tier exposure so that only trusted networks can reach HRMS (UK) endpoints.

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and installation instructions. Apply the update in a test environment before production rollout to validate custom UK Payroll extensions.

Workarounds

Limit HRMS (UK) UK Payroll responsibility assignments to a minimal set of vetted users until patching is complete.
Place the Oracle E-Business Suite web tier behind a web application firewall and enforce strict access controls on UK Payroll URLs.
Increase audit granularity on payroll data objects to shorten detection time for unauthorized modifications.

bash

# Configuration example
# Example: enable auditing on a UK Payroll table (adjust object names to your environment)
sqlplus / as sysdba <<EOF
AUDIT INSERT, UPDATE, DELETE ON HR.PAY_UK_PAYROLL_ACTIONS BY ACCESS;
EXIT;
EOF