CVE-2026-62549: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-62549 Overview

CVE-2026-62549 is an access control vulnerability [CWE-284] in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically within the UK Payroll component. Affected versions span 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can compromise the application without user interaction. The flaw carries a scope change, meaning exploitation impacts resources beyond the vulnerable component. Successful attacks yield unauthorized read, creation, deletion, or modification of all data accessible to Oracle HRMS (UK).

Critical Impact
Network-exploitable authorization flaw allowing an authenticated low-privileged attacker to fully compromise confidentiality and integrity of Oracle HRMS (UK) payroll data with scope change to adjacent products.

Affected Products

Oracle E-Business Suite — Oracle HRMS (UK) version 12.2.3
Oracle E-Business Suite — Oracle HRMS (UK) versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (UK) version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62549 published to the National Vulnerability Database
2026-07-22 - CVE record last updated in NVD

Technical Details for CVE-2026-62549

Vulnerability Analysis

The vulnerability resides in the UK Payroll component of Oracle HRMS (UK), part of Oracle E-Business Suite. It is classified under [CWE-284] Improper Access Control. An attacker requires only a low-privileged account and HTTP reachability to the application server. No user interaction is needed to trigger the flaw. The scope change indicates that successful exploitation influences components outside the vulnerable module's security authority. Impact centers on confidentiality and integrity, with no direct availability effect reported by the vendor.

Root Cause

Oracle attributes the issue to an access control weakness in the UK Payroll component. Authorization checks fail to properly restrict actions available to authenticated users with minimal privileges. As a result, an attacker can perform operations reserved for higher-privileged roles. Because the module interacts with adjacent E-Business Suite services, the failure propagates beyond Oracle HRMS (UK). Oracle has not published implementation-level details beyond the July 2026 Critical Patch Update advisory.

Attack Vector

The attack vector is network-based over HTTP against the E-Business Suite web tier. The attacker authenticates with any low-privileged application account and issues crafted requests to the UK Payroll endpoints. Because the flaw is easily exploitable and does not require user interaction, mass exploitation attempts against exposed E-Business Suite instances are plausible. Successful requests grant full read, create, modify, or delete access to Oracle HRMS (UK) data. Refer to the Oracle Critical Patch Update - July 2026 for authoritative technical guidance.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose because Oracle does not release exploit details in Critical Patch Update advisories.

Detection Methods for CVE-2026-62549

Indicators of Compromise

Unexpected HTTP POST or GET requests to Oracle HRMS (UK) UK Payroll endpoints originating from low-privileged application accounts.
Payroll record creations, modifications, or deletions outside of scheduled payroll processing windows.
Cross-module data access events where a session tied to Oracle HRMS (UK) touches records in adjacent E-Business Suite products.
Authentication events from accounts that historically never accessed HRMS UK Payroll functionality.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the HRMS (UK) responsibility to log user navigation and function invocations.
Correlate application-tier logs with database audit trails on PAY_* and PER_* schemas to spot unauthorized DML activity.
Baseline normal per-role behavior in the UK Payroll module and alert on deviations, particularly write operations from read-only roles.
Ingest E-Business Suite web-tier and database logs into a centralized analytics platform to hunt across sessions and detect scope-change exploitation patterns.

Monitoring Recommendations

Monitor for surges in HTTP 200 responses to Payroll-related URIs paired with low-privileged session identifiers.
Alert on new privilege grants, responsibility assignments, or user creations within Oracle HRMS (UK) following a Payroll module interaction.
Track outbound data volume from the E-Business Suite web tier to detect bulk extraction of payroll records.

How to Mitigate CVE-2026-62549

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite to all affected 12.2.3–12.2.15 environments.
Inventory internet-exposed E-Business Suite instances and restrict access to the HRMS (UK) module to trusted networks and VPNs.
Audit user accounts with any HRMS (UK) responsibility and revoke unused or excessive access.
Review database and application logs for the last 90 days for anomalous Payroll data access.

Patch Information

Oracle addresses CVE-2026-62549 in the July 2026 Critical Patch Update. Administrators must apply the E-Business Suite patches referenced in the Oracle Critical Patch Update - July 2026 advisory. Oracle recommends applying Critical Patch Update fixes without delay because attackers may reverse-engineer patched binaries to develop exploits. No official workaround is provided by Oracle; patching is the supported remediation path.

Workarounds

Place the E-Business Suite web tier behind a web application firewall and block unauthenticated or anomalous requests to Payroll URIs until patching completes.
Temporarily remove or restrict the HRMS (UK) Payroll responsibility from non-essential accounts.
Enforce network segmentation so that only HR and payroll operators can reach the E-Business Suite application servers.
Increase Sign-On Audit level to FORM and enable database fine-grained auditing on Payroll schemas to accelerate detection while patches are staged.

bash

# Apply the July 2026 Oracle Critical Patch Update to E-Business Suite 12.2
# Reference: https://www.oracle.com/security-alerts/cpujul2026.html
source $APPL_TOP/APPS<CONTEXT>.env
adop phase=apply patches=<CPUJUL2026_PATCH_ID> \
     merge=yes \
     workers=8
adop phase=finalize,cutover,cleanup