CVE-2026-61123: Oracle HRMS Information Disclosure Flaw

CVE-2026-61123 Overview

CVE-2026-61123 is a vulnerability in the Oracle Human Resources Management System (HRMS) US product within Oracle E-Business Suite (EBS), specifically in the Internal Operations component. Affected versions include Oracle EBS 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue, though exploitation is rated as difficult. Successful attacks result in unauthorized read access to a subset of HRMS data and can trigger a partial denial of service (DoS) condition. Oracle disclosed the flaw in the Oracle Security Alert July 2026.

Critical Impact
Authenticated attackers can access sensitive HRMS data and degrade availability of the Internal Operations component over HTTP.

Affected Products

Oracle E-Business Suite — Oracle HRMS (US), version 12.2.3
Oracle E-Business Suite — Oracle HRMS (US), versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (US), version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61123 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database
July 2026 - Oracle publishes the Oracle Security Alert July 2026 addressing this issue

Technical Details for CVE-2026-61123

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle HRMS (US), a module of Oracle E-Business Suite handling human resources workflows for US-based deployments. An authenticated attacker with low privileges can issue crafted HTTP requests to interact with the affected component. Successful exploitation yields two outcomes: partial disclosure of HRMS-accessible data and a partial denial-of-service condition impacting HRMS availability.

Exploitation is characterized as difficult, indicating that specific conditions outside the attacker's control must be met. Because HRMS data typically includes employee records, compensation details, and organizational structures, even limited read access carries privacy and compliance implications. The partial DoS impact is scoped to the HRMS module rather than the entire E-Business Suite deployment.

Root Cause

Oracle has not published detailed root-cause analysis for CVE-2026-61123. The advisory categorizes the flaw as impacting confidentiality and availability without affecting integrity. Refer to the Oracle Security Alert July 2026 for vendor-supplied context.

Attack Vector

The attack vector is network-based over HTTP. An attacker must hold valid low-privileged credentials on the target Oracle HRMS (US) instance. No user interaction is required. The exploit targets the Internal Operations component, meaning the attacker must be able to reach the HRMS web-tier endpoints that expose this functionality.

No public proof-of-concept exploit is available. The Exploit Prediction Scoring System (EPSS) probability is 0.203% (percentile 10.459), reflecting a low likelihood of near-term public exploitation.

Detection Methods for CVE-2026-61123

Indicators of Compromise

Anomalous HTTP requests from low-privileged HRMS user accounts targeting Internal Operations endpoints within Oracle E-Business Suite.
Elevated error rates or response latency in the HRMS module coinciding with authenticated session activity.
Unusual volumes of read queries against HRMS tables by accounts that do not typically access those datasets.

Detection Strategies

Enable Oracle E-Business Suite audit logging for HRMS Internal Operations and forward events to a centralized log platform for correlation.
Baseline typical HTTP request patterns per HRMS role and alert on deviations, particularly requests that return unexpected data sets or trigger repeated failures.
Correlate application-tier logs with database audit trails to identify low-privileged sessions accessing HRMS data outside their functional scope.

Monitoring Recommendations

Monitor Oracle EBS middle-tier and Apache access logs for repeated HTTP requests to HRMS Internal Operations URLs from a single session.
Track HRMS module availability metrics and set alerts on partial service degradation that may indicate DoS attempts.
Review authentication logs for low-privileged HRMS accounts exhibiting unusual login times, source IPs, or session durations.

How to Mitigate CVE-2026-61123

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 deployments running HRMS (US).
Inventory HRMS user accounts and revoke or reduce privileges for accounts that do not require access to Internal Operations functionality.
Restrict network exposure of the Oracle EBS HRMS web tier to trusted internal networks and authenticated VPN users.

Patch Information

Oracle addressed CVE-2026-61123 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for patch identifiers and installation prerequisites for Oracle E-Business Suite versions 12.2.3 through 12.2.15. Patching must be scheduled through Oracle's AD Online Patching (adop) framework for 12.2.x environments.

Workarounds

Limit HTTP access to HRMS Internal Operations endpoints using web application firewall (WAF) rules or reverse proxy access control lists until patches are applied.
Enforce least-privilege role assignments in HRMS to minimize the population of accounts capable of reaching the vulnerable component.
Increase logging verbosity on the EBS middle tier to support post-incident forensics if exploitation is suspected.

bash

# Configuration example: apply Oracle EBS 12.2 patch using adop online patching
# Prepare the patching cycle
adop phase=prepare

# Apply the July 2026 CPU patch (replace <patch_top> with the unzipped patch directory)
adop phase=apply patches=<patch_number> workers=8 patchtop=<patch_top>

# Finalize, cutover, and cleanup
adop phase=finalize
adop phase=cutover
adop phase=cleanup