CVE-2026-61267

Received Received - Intake

Unauthenticated Data Manipulation in Oracle HCM Configuration Workbench

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HCM Configuration Workbench accessible data as well as unauthorized read access to a subset of Oracle HCM Configuration Workbench accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Configuration Workbench. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-61267

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	hcm_configuration_workbench	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle HCM Configuration Workbench within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15 and allows unauthenticated attackers to access and modify data remotely via HTTP. The vulnerability has a CVSS score of 7.3, indicating impacts on confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized access attempts to the Oracle HCM Configuration Workbench via HTTP. Check web server logs for unusual requests targeting the Spreadsheet Loading component. Look for repeated or anomalous HTTP POST/GET requests to paths associated with spreadsheet uploads or data modifications.

Impact Analysis

An attacker could exploit this to read, modify, or delete some data in Oracle HCM Configuration Workbench. They could also cause a partial denial of service, disrupting normal operations. No authentication is required, making it easier for attackers to exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update immediately. Restrict network access to the Oracle HCM Configuration Workbench component via firewall rules to limit exposure. Disable unnecessary HTTP interfaces if possible. Monitor for any signs of exploitation and review user access logs for unauthorized activities.

Hi! I’m here to help you understand CVE-2026-61267. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70