CVE-2026-61122: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-61122 Overview

CVE-2026-61122 is a high-severity vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically within the UK Payroll component. The flaw affects supported versions 12.2.9 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle HRMS (UK). Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle HRMS (UK) accessible data. Oracle disclosed this issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers with low privileges can read, modify, and delete all data accessible to the Oracle HRMS (UK) UK Payroll component over the network via HTTP.

Affected Products

Oracle E-Business Suite — Oracle HRMS (UK), version 12.2.9
Oracle E-Business Suite — Oracle HRMS (UK), versions 12.2.10 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (UK), version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61122 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61122

Vulnerability Analysis

The vulnerability resides in the UK Payroll component of Oracle HRMS (UK), a module of Oracle E-Business Suite used to process payroll data for UK-based employees. Oracle's advisory classifies the flaw as easily exploitable over the network via HTTP by an authenticated attacker holding low privileges. No user interaction is required, and the attack does not cross a security boundary beyond the vulnerable component.

Successful exploitation grants an attacker full read access to all data accessible through Oracle HRMS (UK), as well as the ability to create, modify, or delete that data. Given that UK Payroll processes salary, tax, National Insurance, and personal identification data, integrity and confidentiality impacts extend to sensitive employee records. Availability is not affected.

Oracle has not published detailed root-cause information. The behavior described in the advisory — network-accessible HTTP exposure combined with data manipulation by a low-privileged user — is consistent with broken access control or input validation weaknesses common in web-facing E-Business Suite modules.

Root Cause

Oracle's July 2026 Critical Patch Update advisory does not disclose the specific weakness class or CWE. The advisory confirms the vulnerability is reachable via HTTP and exploitable by an authenticated user with low privileges, indicating an authorization or input handling flaw within the UK Payroll HTTP-accessible interface.

Attack Vector

The attack vector is network-based over HTTP. The attacker must first authenticate to the Oracle E-Business Suite instance with any low-privileged account. Once authenticated, the attacker issues crafted HTTP requests to the UK Payroll component to read, modify, or delete data outside of the account's intended scope. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-61122

Indicators of Compromise

Unexpected HTTP requests to Oracle HRMS (UK) UK Payroll endpoints originating from low-privileged user sessions.
Unauthorized create, update, or delete operations recorded in Oracle E-Business Suite audit tables for payroll data.
Access to employee payroll records by accounts that do not have a legitimate business role in payroll processing.

Detection Strategies

Enable Oracle E-Business Suite audit trail (FND_AUDITTRAIL) on UK Payroll tables and review anomalous DML activity by user.
Correlate application server access logs with database audit logs to identify low-privileged sessions performing payroll data changes.
Alert on HTTP requests to UK Payroll URLs originating from user accounts without an assigned payroll responsibility.

Monitoring Recommendations

Forward Oracle E-Business Suite application and database logs to a centralized SIEM for correlation across identity and application layers.
Baseline normal payroll data access patterns and alert on statistical deviations, such as bulk record reads or mass modifications.
Monitor privileged and non-privileged authentication activity against the E-Business Suite login page for unusual geographic or time-based patterns.

How to Mitigate CVE-2026-61122

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite installations running Oracle HRMS (UK) versions 12.2.9 through 12.2.15.
Inventory all E-Business Suite environments, including test and development, to ensure no vulnerable instance is missed.
Review and reduce user accounts with access to the UK Payroll component to the minimum required for business operations.

Patch Information

Oracle addressed CVE-2026-61122 in the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's standard patch application process for Oracle E-Business Suite 12.2.x and validate patch deployment through Oracle's post-patch verification steps.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so that only trusted internal networks and VPN clients can reach the UK Payroll component.
Enforce least-privilege responsibilities in Oracle E-Business Suite and remove UK Payroll access from users who do not require it.
Enable and review Oracle audit trails for UK Payroll tables to detect exploitation attempts until patching is complete.

bash

# Verify installed Oracle E-Business Suite patch level
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF