CVE-2026-62560: Oracle HRMS Information Disclosure Flaw

CVE-2026-62560 Overview

CVE-2026-62560 is an information disclosure vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite, within the Internal Operations component. Affected versions span 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw to gain unauthorized access to sensitive HRMS data. The vulnerability carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Oracle disclosed the issue in the July 2026 Critical Patch Update. The weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated attackers can retrieve confidential HRMS records over the network and impact adjacent Oracle E-Business Suite products through scope change.

Affected Products

Oracle E-Business Suite — Oracle HRMS (Norway) version 12.2.3
Oracle E-Business Suite — Oracle HRMS (Norway) versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (Norway) version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62560 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-62560

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle HRMS (Norway), a localization module of Oracle E-Business Suite. An authenticated attacker with low privileges can send crafted HTTP requests that cause the application to return data the caller is not authorized to view. Because the vulnerability involves a scope change, an attacker who successfully exploits HRMS (Norway) can influence resources managed by other components of the E-Business Suite. Impact is limited to confidentiality; integrity and availability are unaffected. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle's advisory maps the weakness to [CWE-200], indicating that the application discloses sensitive information to actors who should not have access. Root cause details have not been published by Oracle, which is standard practice for E-Business Suite Critical Patch Updates. The scope change indicator suggests that authorization boundaries between HRMS (Norway) and adjacent E-Business Suite modules are not consistently enforced during data retrieval operations.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. The attack complexity is low, and no user interaction is required. Attackers can automate requests against exposed E-Business Suite instances to enumerate accessible HRMS data. Oracle has not released technical exploitation details. Refer to the Oracle Security Alert July 2026 for advisory information.

Detection Methods for CVE-2026-62560

Indicators of Compromise

Unusual HTTP request volume to Oracle E-Business Suite endpoints associated with HRMS (Norway) Internal Operations pages
Access to HRMS URLs by user accounts that historically do not interact with human-resources modules
Bulk queries returning HRMS payloads to low-privileged sessions

Detection Strategies

Review Oracle E-Business Suite application audit logs for unexpected access patterns targeting HRMS (Norway) forms and OA Framework pages
Correlate authenticated session activity with data-volume egress from the E-Business Suite web tier
Flag privilege-role combinations where low-privileged users retrieve HRMS data outside expected business workflows

Monitoring Recommendations

Enable Oracle E-Business Suite Signed Sign-On (SSO) auditing and forward logs to a centralized SIEM for retention and analysis
Monitor web-tier access logs for anomalous HTTP GET/POST volumes against HRMS URLs
Baseline normal HRMS access patterns per user role and alert on deviations

How to Mitigate CVE-2026-62560

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15
Inventory Oracle HRMS (Norway) instances and confirm patch level against the Oracle advisory
Restrict network exposure of the E-Business Suite HTTP tier to trusted management networks where feasible

Patch Information

Oracle addressed CVE-2026-62560 in the July 2026 Critical Patch Update. Administrators should download and apply the relevant patch listed in the Oracle Security Alert July 2026. Follow Oracle's documented patching procedures for E-Business Suite 12.2, including running adop in the intended phases and validating the patch level in AD_BUGS.

Workarounds

Limit HRMS (Norway) responsibilities and function-security grants to users with a validated business need
Place the E-Business Suite web tier behind a reverse proxy or WAF that enforces authentication and rate limiting
Disable unused HRMS localizations if the Norway module is not required in the deployment

bash

# Verify installed Oracle E-Business Suite patch level after applying CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM   ad_bugs
WHERE  bug_number IN ('<CPUJUL2026_BUG_ID>')
ORDER  BY last_update_date DESC;
EOF