CVE-2026-61036
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Oracle HRMS (Norway) versions 12.2.3-12.2.15. Easily exploitable by an authenticated attacker with high privileges, allowing unauthorized update, insert, delete, and read access to payroll data.
Risk Assessment
An attacker can manipulate payroll data, leading to incorrect payments, regulatory violations, and financial losses.
Recommendation
Apply the Oracle patch. Limit the number of high-privilege accounts and regularly audit access to the HRMS system.
Original NVD description (English source)
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Norway) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).