CVE-2026-61251: Oracle HRMS Info Disclosure Vulnerability

CVE-2026-61251 Overview

CVE-2026-61251 is an information disclosure vulnerability in the Human Resource Management System (HRMS) Australia product of Oracle E-Business Suite. The flaw resides in the Payroll component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized access to critical HRMS (Australia) data or complete read access to all data accessible to the application. The issue maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Oracle disclosed the vulnerability in the Oracle Security Alert CPU July 2026.

Critical Impact
A low-privileged network attacker can extract sensitive payroll and HR data belonging to Australian HRMS records without any user interaction.

Affected Products

Oracle E-Business Suite HRMS (Australia) version 12.2.3
Oracle E-Business Suite HRMS (Australia) versions 12.2.4 through 12.2.14
Oracle E-Business Suite HRMS (Australia) version 12.2.15

Discovery Timeline

2026-07-21 - Oracle publishes advisory in Critical Patch Update July 2026
2026-07-21 - CVE-2026-61251 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61251

Vulnerability Analysis

The vulnerability affects the Payroll component of the Oracle E-Business Suite HRMS (Australia) module. An authenticated user with low privileges can issue HTTP requests to the application and retrieve payroll data that should be restricted by role-based access controls. The confidentiality impact is high because the accessible data includes personally identifiable information (PII), salary details, and other payroll records processed by the module. Integrity and availability are not affected, so the attacker cannot modify records or disrupt service through this flaw alone. Oracle rates the flaw as easily exploitable, meaning an attacker does not need specialized conditions or elevated privileges to trigger the disclosure. The Australian HRMS localization handles country-specific payroll calculations and statutory reporting, and this data set is what an exploit would expose.

Root Cause

The root cause aligns with [CWE-200], where the Payroll component returns or exposes data to a caller that lacks authorization to view it. Oracle has not published implementation-level detail. Based on the CWE classification and the confidentiality-only impact, the defect involves missing or insufficient authorization enforcement at an HTTP-accessible endpoint within the Payroll module.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle E-Business Suite web tier. The attacker must hold valid credentials at any low-privilege level within the application. Once authenticated, the attacker sends crafted HTTP requests to the vulnerable Payroll endpoints to retrieve data outside their authorized scope. No user interaction and no social engineering are required, and the attack does not cross a security boundary such as a browser sandbox.

No public proof-of-concept code is available. Refer to the Oracle Security Alert CPU July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-61251

Indicators of Compromise

Unusual volumes of HTTP requests from low-privileged accounts to Payroll servlet paths under the Oracle E-Business Suite /OA_HTML/ or /pls/ URL space.
Application audit records showing access to HRMS (Australia) Payroll data by users whose responsibility assignments do not include payroll functions.
Repeated parameter manipulation in URLs or POST bodies targeting employee IDs, organization IDs, or payroll run identifiers.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking, then hunt for access to Payroll functions by users outside the payroll responsibility group.
Correlate web tier access logs with FND_USER identity data to detect enumeration patterns against Payroll endpoints.
Deploy web application firewall (WAF) rules that alert on rapid, sequential requests to HRMS Payroll URIs from a single session.

Monitoring Recommendations

Forward Oracle E-Business Suite audit logs and Apache access logs to a centralized SIEM or data lake for retention and analytics.
Baseline normal Payroll module usage per role, and alert when low-privileged accounts deviate from that baseline.
Monitor database-tier access to PAY_% and PER_% tables for query patterns originating from application accounts tied to non-payroll users.

How to Mitigate CVE-2026-61251

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory all users assigned HRMS (Australia) responsibilities and remove access that is not required for current job duties.
Rotate credentials for any low-privileged accounts that showed anomalous Payroll access prior to patching.

Patch Information

Oracle addressed CVE-2026-61251 in the July 2026 Critical Patch Update. Administrators should download the applicable patch for their release from My Oracle Support and follow the deployment steps outlined in the Oracle Security Alert CPU July 2026. Patch application on Oracle E-Business Suite 12.2 environments requires online patching through adop and validation in a non-production environment before rollout.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier so that only trusted internal networks and VPN clients can reach HRMS URLs.
Tighten Oracle E-Business Suite responsibility and menu exclusions to remove Payroll function access from any role that does not strictly require it.
Enforce multi-factor authentication (MFA) at the Oracle Access Manager or reverse proxy layer to reduce the risk of credential-based access by low-privileged accounts.

bash

# Example: apply the July 2026 CPU using adop online patching
cd $PATCH_TOP
adop phase=prepare
adop phase=apply patches=<CPU_JUL2026_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup