CVE-2026-62557: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-62557 Overview

CVE-2026-62557 is an access control weakness [CWE-284] in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically within the UK Payroll component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation grants unauthorized read access to all Oracle HRMS (UK) accessible data and unauthorized update, insert, or delete access to a subset of that data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can read all payroll data and modify a subset of HRMS records, exposing UK employee compensation and personally identifiable information.

Affected Products

Oracle E-Business Suite — Oracle HRMS (UK), UK Payroll component
Supported versions 12.2.3 through 12.2.15
Deployments exposing Oracle E-Business Suite HTTP endpoints to network-reachable users

Discovery Timeline

2026-07-21 - CVE-2026-62557 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle releases fix in the Critical Patch Update

Technical Details for CVE-2026-62557

Vulnerability Analysis

The vulnerability resides in the UK Payroll component of Oracle HRMS (UK), part of the Oracle E-Business Suite. It is categorized under Improper Access Control [CWE-284]. An authenticated user with low privileges can send crafted HTTP requests to reach payroll functionality that should require higher authorization. The scope remains unchanged, meaning the vulnerable component and the impacted component are the same. Confidentiality impact is high because attackers can retrieve all data accessible to Oracle HRMS (UK). Integrity impact is limited because only a subset of records can be modified. Availability is not affected. EPSS data as of 2026-07-22 indicates a low probability of near-term mass exploitation, but the exposure of UK payroll data — including salary, tax, and identity information — makes this a priority for regulated environments.

Root Cause

Oracle has not published component-level technical detail. The CWE-284 classification indicates that authorization checks within the UK Payroll module do not correctly restrict actions available to low-privileged accounts. Access decisions likely rely on parameters or role assumptions that a standard EBS user can influence through HTTP interactions.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. No user interaction is required. The attacker issues HTTP requests to UK Payroll endpoints and receives payroll data or performs unauthorized writes. Because Oracle EBS is frequently exposed to intranet users, insider abuse and credential-based lateral movement are realistic paths to exploitation.

No public proof-of-concept or exploit code is available. Refer to the Oracle Security Advisory July 2026 for the authoritative patch matrix.

Detection Methods for CVE-2026-62557

Indicators of Compromise

Authenticated HTTP requests from low-privileged EBS accounts to UK Payroll URLs outside normal business workflows
Bulk queries or exports of employee, salary, or tax records by accounts that do not typically access payroll data
Unexpected INSERT, UPDATE, or DELETE activity against HRMS payroll tables originating from application service accounts

Detection Strategies

Enable Oracle E-Business Suite audit logging for the HRMS (UK) and UK Payroll modules and forward events to a central SIEM
Baseline normal payroll access patterns per user role and alert on deviations, including off-hours activity and access from unusual source addresses
Correlate web tier access logs with database-level auditing to identify low-privileged sessions reaching payroll functionality

Monitoring Recommendations

Monitor for repeated 200-response HTTP calls to UK Payroll servlets from accounts lacking payroll responsibilities
Track privilege assignment changes in Oracle User Management to detect suspicious role escalations preceding payroll access
Alert on database changes to HRMS payroll schemas that occur outside scheduled payroll runs

How to Mitigate CVE-2026-62557

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments
Inventory user accounts with access to Oracle HRMS (UK) and revoke unnecessary responsibilities, especially for shared or service accounts
Restrict network reachability of EBS HTTP endpoints to trusted segments using firewall and reverse proxy controls

Patch Information

Oracle addressed CVE-2026-62557 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Advisory July 2026 for the specific patch identifiers matching each supported EBS 12.2.x release and apply them following Oracle's recommended sequence.

Workarounds

Temporarily remove UK Payroll responsibilities from low-privileged users until the CPU patch is applied
Place Oracle EBS behind a reverse proxy that enforces URL-level access controls for payroll endpoints
Enable enhanced database auditing on HRMS payroll tables to record every read and write action for forensic review

bash

# Configuration example: enable fine-grained auditing on an HRMS payroll table
sqlplus / as sysdba <<EOF
BEGIN
  DBMS_FGA.ADD_POLICY(
    object_schema   => 'HR',
    object_name     => 'PAY_PAYROLL_ACTIONS',
    policy_name     => 'FGA_UK_PAYROLL_READ',
    statement_types => 'SELECT,INSERT,UPDATE,DELETE',
    audit_trail     => DBMS_FGA.DB_EXTENDED);
END;
/
EOF