CVE-2026-71101

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle HRMS (US)

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: Oracle

Description

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-71101

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	human_resources_management_system	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle HRMS (US) within Oracle E-Business Suite, specifically affecting versions 12.2.3 to 12.2.15. It allows a low-privileged attacker with local access to take over the Oracle HRMS (US) system due to improper security controls in the US Payroll Tax Issues component.

Detection Guidance

This vulnerability affects Oracle HRMS (US) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. Detection requires checking for unpatched versions of Oracle HRMS (US) in your Oracle E-Business Suite environment. Review Oracle's security patches and ensure your system is updated to a non-vulnerable version.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full control over the Oracle HRMS (US) system. This may lead to unauthorized access to sensitive payroll and tax data, potential data manipulation, and disruption of HR and payroll operations.

Compliance Impact

This vulnerability could lead to breaches of sensitive employee data, which may violate GDPR (if personal data is involved) and HIPAA (if protected health information is processed). Non-compliance risks include legal penalties, fines, and reputational damage.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in the HRMS (US) component. Ensure all affected versions (12.2.3-12.2.15) are updated to a patched release.

Hi! I’m here to help you understand CVE-2026-71101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70