CVE-2026-61255: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-61255 Overview

CVE-2026-61255 affects the Oracle HRMS (New Zealand) product within Oracle E-Business Suite, specifically the New Zealand Payroll component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation grants unauthorized update, insert, or delete access to some Oracle HRMS (New Zealand) data, along with read access to a subset of accessible data. The weakness is categorized under [CWE-284] (Improper Access Control).

Critical Impact
Authenticated attackers can modify or read sensitive payroll and human resources data belonging to New Zealand employees processed through Oracle E-Business Suite.

Affected Products

Oracle E-Business Suite — Oracle HRMS (New Zealand) version 12.2.3
Oracle E-Business Suite — Oracle HRMS (New Zealand) versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (New Zealand) version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61255 published to NVD
2026-07-22 - Last updated in NVD database
Oracle addressed the issue in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61255

Vulnerability Analysis

The vulnerability resides in the New Zealand Payroll component of Oracle HRMS, part of Oracle E-Business Suite. An attacker who holds a low-privileged application account can send crafted HTTP requests to interact with functionality that lacks sufficient access controls. The result is unauthorized write access to a portion of the HRMS (New Zealand) data set, plus unauthorized read access to a subset of the same data. Availability is not impacted, and the exploit does not require user interaction. The EPSS probability is 0.22% at the 12.6 percentile, indicating limited near-term exploitation activity based on public signals.

Root Cause

The underlying weakness is Improper Access Control ([CWE-284]). The affected component does not adequately verify whether the authenticated caller is authorized to perform specific read and write operations against payroll records. This allows a user with legitimate but low-privileged credentials to reach data and actions intended for higher-privileged roles.

Attack Vector

An authenticated attacker with network reachability to the Oracle E-Business Suite web tier issues HTTP requests to the vulnerable New Zealand Payroll endpoints. Because the scope remains unchanged, the impact is confined to the Oracle HRMS (New Zealand) application. No exploit code is publicly available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been released. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-provided technical context.

Detection Methods for CVE-2026-61255

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements against New Zealand Payroll tables originating from accounts that normally perform read-only operations.
HTTP requests from low-privileged users to New Zealand Payroll URLs outside of their functional responsibilities.
Anomalous access to employee compensation, tax, or bank account fields recorded in Oracle E-Business Suite audit tables.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate user roles with accessed payroll pages.
Baseline normal payroll workflow activity per role and alert on deviations, particularly write operations from accounts that lack payroll administration duties.
Inspect application-tier web server logs for repeated HTTP requests targeting HRMS New Zealand Payroll servlets from a single low-privileged session.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web tier logs to a centralized SIEM for cross-source correlation.
Monitor FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, and payroll table audit trails for privilege misuse patterns.
Track changes to Oracle HRMS responsibility assignments and menu exclusions that could broaden a user's effective access.

How to Mitigate CVE-2026-61255

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running HRMS (New Zealand) versions 12.2.3 through 12.2.15.
Inventory user accounts with access to New Zealand Payroll responsibilities and remove entitlements that exceed job requirements.
Review recent payroll data changes for unexpected modifications performed by non-administrative accounts.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Consult the Oracle Critical Patch Update July 2026 advisory for the specific patch identifiers applicable to your Oracle E-Business Suite 12.2 release and platform.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier to trusted corporate networks and VPN ranges until patches are applied.
Temporarily remove or tighten New Zealand Payroll responsibilities for users who do not require them.
Increase audit logging verbosity on payroll-related forms and database tables to detect exploitation attempts during the patch window.

bash

# Example: apply Oracle E-Business Suite patch via adop in hotpatch/patching cycle
adop phase=apply patches=<CPU_JUL_2026_PATCH_ID> hotpatch=yes
adop phase=cleanup