CVE-2026-61075

Analyzed Analyzed - Analysis Complete

Oracle Self-Service HR Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data as well as unauthorized read access to a subset of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61075

EUVD

EUVD-2026-47286

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	self-service_human_resources	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Self-Service Human Resources within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized read, update, insert, or delete access to some of the application's data.

Detection Guidance

Detection requires checking if Oracle Self-Service Human Resources versions 12.2.3-12.2.15 are installed and exposed via HTTP. Review Oracle E-Business Suite logs for unusual data access or modification patterns in the Human Resources component.

Impact Analysis

An attacker could modify or steal sensitive HR data, such as employee records or personal information. This could lead to data breaches, privacy violations, or unauthorized changes to critical HR information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized access or modification of protected data. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Apply Oracle's official security patches for versions 12.2.3-12.2.15. Restrict network access to the Oracle Self-Service Human Resources component via HTTP. Implement least-privilege access controls for users.

Hi! I’m here to help you understand CVE-2026-61075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70