CVE-2026-60965

Analyzed Analyzed - Analysis Complete

Oracle HRMS (France) Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (France) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60965

EUVD

EUVD-2026-47217

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	human_resources_management_system	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle HRMS (France) within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access via HTTP can exploit it to compromise the system. Successful exploitation may allow unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all Oracle HRMS (France) accessible data.

Detection Guidance

Detection requires checking for Oracle E-Business Suite versions 12.2.3 to 12.2.15 with the French HR component exposed to HTTP. Inspect Oracle application logs for unusual data access or modification patterns. Use network scans to identify Oracle HRMS (France) services on port 80 or 443.

Impact Analysis

If you use Oracle HRMS (France) in versions 12.2.3 to 12.2.15, an attacker could gain unauthorized access to sensitive HR data. This may lead to data breaches, loss of confidential employee information, or unauthorized modifications to critical records, potentially disrupting HR operations.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive personal data, violating GDPR and HIPAA requirements. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if such data breaches occur.

Mitigation Strategies

Apply Oracle's latest security patches for Oracle HRMS (France) immediately. Restrict HTTP access to the component via firewall rules or disable it if unused. Upgrade to a non-vulnerable version if possible. Monitor critical data for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-60965. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70