CVE-2026-61117

Executive Summary

This report details CVE-2026-61117, a Medium-severity vulnerability in Oracle HRMS (UK), a component of Oracle E-Business Suite. The flaw allows a low-privileged attacker with network access to compromise the confidentiality of critical data. While difficult to exploit, a successful attack can lead to unauthorized read access to all data within the Oracle HRMS (UK) application and potentially impact other products due to a scope change.

Business Impact: Organizations in the UK and globally that rely on Oracle E-Business Suite for Human Resources management are at risk. The likely attacker is a low-privileged insider or an external actor who has already gained initial access to the network. The primary risk is the exfiltration of sensitive HR data, including Personally Identifiable Information (PII), payroll details, and organizational structures.

Vulnerability Class & Attack Vector: This is an information disclosure vulnerability (CWE-200) accessible over the network via HTTP. It requires authentication at a low privilege level and is considered difficult to exploit.

Urgency Assessment: Despite a CVSS score of 6.3, the urgency is tempered by the high attack complexity (AC:H) and the current EPSS probability of 0.0%, indicating no observed exploitation in the wild. However, the potential for significant data breach and the scope change to other products warrants immediate attention for patching as soon as a fix is available.

Key Facts:

• Vendor: Oracle
• Affected Software: Oracle HRMS (UK) within Oracle E-Business Suite
• Affected Versions: 12.2.8 through 12.2.15
• Patch Status: None available as of 2026-07-22.
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity: Medium

The CVSS score of 6.3 is derived from the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

• AV:N (Network): The vulnerability is exploitable remotely over the network. No physical or local access is required.
• AC:H (High): The attack is difficult to execute. This could be due to specific timing windows, race conditions, or the need for specialized knowledge about the target environment's configuration.
• PR:L (Low): The attacker must have valid credentials, but only at a low-privilege level (e.g., a standard user or operator role).
• UI:N (None): The attack does not require any interaction from a victim user. The attacker can execute the exploit autonomously.
• S:C (Changed): A successful attack can impact resources beyond the vulnerable component. This implies the attacker can pivot from the HRMS module to affect other parts of the E-Business Suite.
• C:H (High): There is a total loss of confidentiality. The attacker can read all data accessible within the Oracle HRMS (UK) application.
• I:N (None): There is no impact to the integrity of the data.
• A:N (None): There is no impact to the availability of the system.

EPSS Interpretation: The Exploit Prediction Scoring System (EPSS) probability of 0.0% means that, based on current threat intelligence, there is an extremely low probability of this CVE being exploited in the wild within the next 30 days. This is common for newly published vulnerabilities that are difficult to exploit and for which no public PoC exists.

Historical Comparison: This vulnerability is similar in nature to other information disclosure flaws in Oracle E-Business Suite, such as CVE-2022-21587 (CWE-200) and CVE-2023-21912 (CWE-200), which also allowed low-privileged attackers to access sensitive data. These historical CVEs were also rated Medium severity and often required complex attack conditions.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability resides in the "Internal Operations" component of Oracle HRMS (UK). The root cause is likely a failure to properly enforce access controls on specific internal API endpoints or data retrieval functions. A low-privileged user may be able to craft a request that bypasses authorization checks, allowing them to query data intended for higher-privileged roles (e.g., HR administrators).

Step-by-Step Attack Mechanics:

1. Authentication: The attacker authenticates to the Oracle E-Business Suite web interface with a low-privileged account (e.g., an employee self-service user).
2. Reconnaissance: The attacker identifies the specific HTTP endpoints or parameters used by the HRMS (UK) module for internal operations. This could involve analyzing JavaScript files, web forms, or using automated scanners.
3. Crafting the Malicious Request: The attacker crafts a specially formed HTTP request (likely a GET or POST) to a vulnerable endpoint. The request may include manipulated parameters (e.g., person_id, organization_id, request_type) that the server does not properly validate against the user's authorization scope.
4. Exploitation: The server processes the request and returns data that should be restricted. Due to the high attack complexity (AC:H), this step may require specific conditions, such as a particular application state, a race condition, or the use of a deprecated function.
5. Data Exfiltration: The attacker receives the sensitive data in the HTTP response. Due to the scope change (S:C), this data could include information from other integrated Oracle E-Business Suite modules.

Attack Surface: The attack surface is the HTTP/HTTPS web interface of the Oracle E-Business Suite, typically on ports 8000 (HTTP) and 4443 (HTTPS). The specific vulnerable endpoints are within the /OA_HTML/ or /OA_JAVA/ paths associated with the HRMS (UK) module.

Pre-conditions:

• Network access to the Oracle E-Business Suite server.
• A valid low-privileged user account.
• The target system must be running a vulnerable version (12.2.8 - 12.2.15).

Why Standard Defenses May Fail: Standard Web Application Firewalls (WAFs) may not block this attack because the request appears to be a legitimate, authenticated API call. The malicious payload is not a typical SQL injection or XSS string, but rather a manipulation of business logic parameters. Anomaly-based detection systems might flag the unusual data access pattern, but this requires fine-tuned baselines.

Vulnerable vs. Patched Code Analysis

As no patch or specific code details are available from the provided data, a precise side-by-side analysis is not possible. However, based on the vulnerability description, the fix would likely involve:

• Vulnerable Code (Conceptual):

  // Vulnerable: No check if the requesting user has access to the requested person_id
  public String getEmployeeDetails(String person_id) {
      String query = "SELECT * FROM per_all_people_f WHERE person_id = " + person_id;
      // ... execute query and return results
  }
  

• Patched Code (Conceptual):

  // Patched: Added authorization check
  public String getEmployeeDetails(String requesting_user_id, String person_id) {
      if (!authorizationService.canUserAccessPersonData(requesting_user_id, person_id)) {
          throw new AuthorizationException("Access Denied");
      }
      String query = "SELECT * FROM per_all_people_f WHERE person_id = " + person_id;
      // ... execute query and return results
  }
  

The patch would add a robust authorization layer to ensure that a user can only access data for which they have explicit permission, preventing the low-privilege escalation.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T21:38:16.326Z
• Estimated Discovery: Unknown. The vulnerability was likely discovered by an internal Oracle security researcher or reported through a bug bounty program.
• Disclosure Process: Oracle, as the CNA (CVE Numbering Authority), coordinated the disclosure. The CVE was published on the NVD and CVE.org databases.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-22.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: The most likely threat actors to exploit this vulnerability are:

• Insider Threats: A disgruntled or malicious employee with low-level access seeking to exfiltrate HR data for personal gain or to sell.
• Nation-State Actors: APT groups targeting government or defense contractor HR systems to gather intelligence on personnel.
• Cybercriminals: Groups specializing in data theft for extortion or sale on dark web markets.

Attack Campaign Context: This CVE is not currently associated with any known broader attack campaigns.

Geographic Targeting: The vulnerability is specifically in the "UK" localization of Oracle HRMS, making organizations operating in the United Kingdom the primary targets.

Industry Verticals Most at Risk:

• Government (UK central and local)
• Healthcare (NHS Trusts)
• Financial Services
• Education
• Any large enterprise using Oracle E-Business Suite for UK HR operations.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A virtual machine running Oracle Linux 7 or 8.
2. Software: Oracle E-Business Suite Release 12.2.8 (or a version within the affected range) with the HRMS (UK) module installed.
3. Network: The VM should be on an isolated network segment. The web interface (port 8000) should be accessible from an attacker VM (e.g., Kali Linux).
4. Credentials: Create a low-privileged user account (e.g., EMPLOYEE1 with password Welcome1).

Exploitation Walkthrough (Conceptual):

1. Login: Use a tool like curl or Burp Suite to authenticate as the low-privileged user.

   curl -c cookies.txt -d "username=EMPLOYEE1&password=Welcome1" http://target:8000/OA_HTML/AppsLogin
   

2. Identify Endpoint: Use a web proxy to intercept traffic while navigating the HRMS self-service interface. Identify a request that fetches user details, e.g., GET /OA_HTML/GetUserDetails.jsp?person_id=100.
3. Manipulate Parameter: Modify the person_id parameter to a value belonging to a high-privilege user (e.g., person_id=1).

   curl -b cookies.txt "http://target:8000/OA_HTML/GetUserDetails.jsp?person_id=1"
   

4. Expected Output: If the vulnerability is present, the server will return the sensitive details of the high-privilege user (e.g., salary, bank details, national insurance number) without proper authorization.

Post-Exploitation: After gaining access to sensitive data, the attacker can exfiltrate it. The scope change (S:C) suggests they might also be able to use this foothold to attack other modules, potentially leading to a full compromise of the E-Business Suite.

Blue Team Section

Detection:

• Log Entries: Monitor Oracle E-Business Suite audit logs for unusual patterns of data access, such as a single user querying a large number of person_id values in a short period.
• Network Traffic: Look for HTTP requests to HRMS endpoints with sequential or out-of-range person_id parameters from a single authenticated session.
• Endpoint Indicators: The web server logs (e.g., access.log) will show the anomalous requests. The application server logs may show authorization failures if the attack is partially blocked.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE-2026-61117_Oracle_HRMS_Data_Access {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2026-61117 in Oracle HRMS (UK)"
        author = "Valters IT Hub"
        date = "2026-07-22"
        reference = "https://www.valtersit.com/cve/cve-2026-61117"
    strings:
        $s1 = "/OA_HTML/GetUserDetails.jsp" ascii wide nocase
        $s2 = "person_id=" ascii wide nocase
        $s3 = "HRMSInternalOp" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and filesize < 10KB
}

Sigma Rule (SIEM)

title: CVE-2026-61117 Oracle HRMS Data Exfiltration Attempt
id: a0822035-1e5d-4523-9ec0-9dbf1a82c97d
status: experimental
description: Detects potential exploitation of CVE-2026-61117 by monitoring for unusual access patterns to Oracle HRMS endpoints.
author: Valters IT Hub
date: 2026-07-22
references:
    - https://www.valtersit.com/cve/cve-2026-61117
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem:
            - '/OA_HTML/GetUserDetails.jsp'
            - '/OA_HTML/HRMSInternalOp'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate HR administrators performing bulk data exports.
level: high

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-61117 Oracle HRMS Data Access Attempt";
    flow:to_server,established;
    content:"/OA_HTML/GetUserDetails.jsp"; http_uri;
    content:"person_id="; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Elastic (EQL) Query

sequence by source.ip
  [network where http.request.method == "GET" and
   url.path == "/OA_HTML/GetUserDetails.jsp" and
   url.query contains "person_id="]
  with maxspan=5m
  | stats count by source.ip
  | where count > 50

Splunk SPL Query

index=web sourcetype=access_combined
uri_path="/OA_HTML/GetUserDetails.jsp" uri_query=*person_id=*
| stats count by clientip, user
| where count > 50

Wazuh Rule

<group name="oracle_ebs,">
  <rule id="100001" level="12">
    <decoded_as>web</decoded_as>
    <field name="url">/OA_HTML/GetUserDetails.jsp</field>
    <field name="url">person_id=</field>
    <description>CVE-2026-61117: Potential Oracle HRMS data access attempt from $(srcip)</description>
    <group>cve_2026_61117,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• Patch: No patch is available. Monitor Oracle's security advisory page for the release of a Critical Patch Update (CPU).
• Compensating Controls:
  • Network Segmentation: Restrict network access to the Oracle E-Business Suite web interface to only trusted IP ranges.
  • WAF Rules: Deploy a temporary WAF rule to block requests to known sensitive HRMS endpoints (e.g., /OA_HTML/GetUserDetails.jsp) from low-privilege user sessions.
  • Account Review: Immediately review and disable any dormant or unnecessary low-privilege accounts.

Short-term (1-7 days)

• Configuration Hardening: Review and tighten authorization profiles within Oracle HRMS. Ensure the principle of least privilege is enforced.
• Monitoring Implementation: Deploy the detection rules provided in this report to SIEM and IDS systems.
• Vulnerability Scanning: Use an authenticated scanner (e.g., Qualys, Nessus) to confirm the presence of the vulnerable component.

Long-term

• Architecture: Consider implementing a Zero Trust architecture where every API call is authenticated and authorized, regardless of the user's network location.
• Security Controls: Implement a robust User and Entity Behavior Analytics (UEBA) solution to detect anomalous data access patterns.
• Developer Training: Emphasize secure coding practices, particularly around authorization checks for internal operations.

Validation: To confirm a patch is applied, check the version of the Oracle E-Business Suite. The patched version will be announced in the next Oracle Critical Patch Update advisory. Run SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS; in the database to verify the current version.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61117
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-61117
• Vendor advisory: See Oracle's Critical Patch Update advisory page.
• OSV: https://osv.dev/vulnerability/CVE-2026-61117
• Related CWE: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-22 | https://www.valtersit.com/cve/cve-2026-61117