CVE-2026-61214
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vulnerability in Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll) in versions 12.2.3-12.2.15. A difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle HRMS (UK) data. CVSS 3.1 Base Score 2.2 (Confidentiality impact).
Risk Assessment
The organization is at risk of leakage of sensitive HR data (UK Payroll) by a high-privileged attacker, but due to the difficulty of exploitation, the risk is low.
Recommendation
Apply the patch available in the Oracle Critical Patch Update for the corresponding Oracle E-Business Suite version.
Original NVD description (English source)
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).