CVE-2026-62567: Oracle HRMS UK Payroll Data Disclosure

CVE-2026-62567 Overview

CVE-2026-62567 is an information disclosure vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, affecting the UK Payroll component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with HTTP network access can exploit the flaw to gain unauthorized access to critical data across Oracle HRMS (UK). The vulnerability involves a scope change, meaning attacks originating in Oracle HRMS (UK) can significantly impact additional Oracle E-Business Suite products. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized access to critical or all Oracle HRMS (UK) accessible data, including UK payroll records, and can affect additional in-scope Oracle products.

Affected Products

Oracle E-Business Suite - Oracle HRMS (UK), version 12.2.3
Oracle E-Business Suite - Oracle HRMS (UK), versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle HRMS (UK), version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62567 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-62567

Vulnerability Analysis

CVE-2026-62567 is categorized as an information exposure issue [CWE-200] in the UK Payroll component of Oracle HRMS (UK). An authenticated attacker with low privileges can send crafted HTTP requests to reach protected payroll data. The flaw exposes confidential information but does not modify data or affect availability. The scope change in the CVSS vector indicates the vulnerable component can influence resources managed by other security authorities, extending impact beyond Oracle HRMS (UK) to additional Oracle E-Business Suite modules. Because exploitation requires only network access and any low-privileged Oracle E-Business Suite account, insider threats and compromised low-tier accounts represent realistic attack scenarios.

Root Cause

The root cause is insufficient access control within the UK Payroll component that allows a low-privileged user to reach data intended for restricted roles. Oracle has not published low-level technical details, following its standard Critical Patch Update disclosure practice. The Oracle July 2026 Critical Patch Update advisory documents the affected versions and fix availability.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates to the Oracle E-Business Suite environment with any low-privileged account, then issues requests to the vulnerable UK Payroll functionality. No user interaction is required. Because the vulnerability produces a scope change, data belonging to related Oracle E-Business Suite products may be reachable through the same request path. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Oracle has not released exploitation code and no verified public proof-of-concept exists. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-62567

Indicators of Compromise

Unusual HTTP requests from low-privileged Oracle E-Business Suite accounts targeting UK Payroll URLs and servlets under /OA_HTML/ or oracle.apps.per.* endpoints.
Anomalous volume of read operations against UK payroll tables such as PAY_* and PER_* from application service accounts.
HTTP responses returning payroll or personnel data to sessions whose role assignments should not permit that access.

Detection Strategies

Correlate Oracle E-Business Suite application server access logs with role assignments to identify low-privileged users retrieving UK Payroll data.
Enable and review Oracle Database fine-grained auditing on UK Payroll schemas to flag out-of-role SELECT activity.
Baseline normal UK Payroll access patterns per user and alert on statistical deviations, particularly cross-module data access consistent with the scope change behavior.

Monitoring Recommendations

Forward Oracle E-Business Suite middle-tier, database audit, and web listener logs to a centralized analytics platform such as Singularity Data Lake for correlation with identity telemetry.
Monitor authentication and session activity for Oracle E-Business Suite accounts with Singularity Identity to detect credential misuse against HRMS endpoints.
Track outbound data transfer volumes from Oracle E-Business Suite application servers to detect bulk payroll data extraction.

How to Mitigate CVE-2026-62567

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3-12.2.15 environments running Oracle HRMS (UK).
Inventory low-privileged Oracle E-Business Suite accounts and revoke access that is not required for business operations.
Review Oracle E-Business Suite audit trails for the past 90 days for unexpected UK Payroll data access.

Patch Information

Oracle addressed CVE-2026-62567 in the July 2026 Critical Patch Update. Administrators should download and deploy the patches referenced in the Oracle Security Alert July 2026. Oracle recommends applying Critical Patch Updates without delay because supported product versions receive fixes only through this channel.

Workarounds

Restrict network access to Oracle E-Business Suite application servers to trusted corporate networks and VPN ranges until patches are deployed.
Enforce least-privilege role assignments in Oracle E-Business Suite and remove UK Payroll responsibility from users who do not require it.
Enable Oracle Database auditing on UK Payroll schemas and require multi-factor authentication for all Oracle E-Business Suite users to raise the exploitation barrier.

bash

# Reference only - consult Oracle documentation before applying
# Verify installed Oracle E-Business Suite patch level
sqlplus apps/<password> @$AD_TOP/sql/adutconf.sql

# List applied patches to confirm July 2026 CPU deployment
adop -status