CVE-2026-61252: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-61252 Overview

CVE-2026-61252 is an access control vulnerability [CWE-284] in the Oracle Human Resources Management System (HRMS) for Hong Kong, part of the Oracle E-Business Suite. The flaw resides in the Hong Kong Payroll component and affects supported versions 12.2.13 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability to gain unauthorized read access to a subset of HRMS data. The attacker can also perform unauthorized insert, update, or delete operations against some accessible data. Oracle disclosed the vulnerability in the Oracle Critical Patch Update Advisory for July 2026.

Critical Impact
Authenticated attackers with low privileges can modify and read subsets of payroll and human resources data over the network, impacting confidentiality and integrity of employee records.

Affected Products

Oracle E-Business Suite — Oracle HRMS (Hong Kong) version 12.2.13
Oracle E-Business Suite — Oracle HRMS (Hong Kong) version 12.2.14
Oracle E-Business Suite — Oracle HRMS (Hong Kong) version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61252 published to the National Vulnerability Database
2026-07-22 - Entry last modified in NVD

Technical Details for CVE-2026-61252

Vulnerability Analysis

CVE-2026-61252 is an improper access control weakness [CWE-284] in the Hong Kong Payroll component of Oracle HRMS. The issue permits an authenticated user holding only low privileges to reach payroll-related functionality and data that should be restricted to higher-privileged roles. Successful exploitation grants read access to a subset of HRMS data and write access sufficient to insert, update, or delete records that the attacker should not control.

Because the attack traverses HTTP and requires no user interaction, an attacker positioned on the network with any valid session can attempt exploitation directly against the E-Business Suite front end. The scope remains unchanged, so the impact is contained within the HRMS application boundary. Confidentiality and integrity are affected at a limited level; availability is not impacted.

Root Cause

The root cause is missing or incorrectly enforced authorization checks within the Hong Kong Payroll code paths. The application accepts requests from authenticated principals without verifying that the caller possesses the role or entitlement required to read or modify the target payroll data set.

Attack Vector

Exploitation requires network access to the E-Business Suite HTTP interface and valid low-privileged credentials. The attacker submits crafted requests to Hong Kong Payroll endpoints to reach protected data or invoke unauthorized data modification operations. No social engineering or user interaction is required.

Refer to the Oracle Critical Patch Update Advisory - July 2026 for the vendor's technical description and fix availability.

Detection Methods for CVE-2026-61252

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Oracle HRMS Hong Kong Payroll tables performed by low-privileged application users.
Access to Hong Kong Payroll HTTP endpoints by user accounts that are not assigned Payroll or HR administrative responsibilities.
Anomalous session activity originating from application accounts outside their normal working hours or geographies.

Detection Strategies

Review Oracle E-Business Suite audit logs (FND_LOG_MESSAGES, sign-on audit, and page-access tracking) for unauthorized navigation to Hong Kong Payroll functions.
Enable and inspect Oracle database Fine-Grained Auditing on payroll-related tables to capture read and write operations tied to specific application users.
Correlate HTTP access logs from the Oracle HTTP Server tier with application user identity to spot low-privileged users hitting payroll URLs.

Monitoring Recommendations

Forward E-Business Suite application, middle-tier, and database audit logs to a centralized analytics platform for correlation and retention.
Alert on privilege deviations where a user without an HR or Payroll responsibility accesses payroll functions or data.
Baseline normal payroll data modification patterns and alert on deviations in volume or timing.

How to Mitigate CVE-2026-61252

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.13 through 12.2.15.
Inventory all E-Business Suite environments, including development and test tiers, and prioritize patching production systems that host Hong Kong Payroll data.
Audit user responsibilities and remove any Hong Kong Payroll access that is not required for a user's job function.

Patch Information

Oracle addressed CVE-2026-61252 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patches for Oracle E-Business Suite 12.2.13, 12.2.14, and 12.2.15 as documented in the Oracle Critical Patch Update Advisory - July 2026.

Workarounds

Restrict network access to the E-Business Suite HTTP tier so that only trusted internal networks or VPN users can reach the application.
Enforce least privilege on E-Business Suite responsibilities and remove standing access to Hong Kong Payroll functions where not required.
Enable database and application auditing on payroll objects until the patch is deployed to shorten the window between exploitation and detection.

bash

# Configuration example: enable Fine-Grained Auditing on a payroll table
BEGIN
  DBMS_FGA.ADD_POLICY(
    object_schema   => 'HR',
    object_name     => 'PAY_HK_PAYROLL_ACTIONS',
    policy_name     => 'FGA_HK_PAYROLL_RW',
    statement_types => 'SELECT,INSERT,UPDATE,DELETE',
    audit_trail     => DBMS_FGA.DB_EXTENDED
  );
END;
/