Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html |
|
History
Thu, 20 Aug 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Low‑Privilege Exploit Enables Full Oracle HRMS (US) Compromise |
Thu, 20 Aug 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Privilege Escalation in Oracle HRMS (US) Payroll Tax Issues |
Thu, 20 Aug 2026 06:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Privilege Escalation in Oracle HRMS (US) Payroll Tax Issues | |
| Weaknesses | CWE-269 |
Wed, 19 Aug 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Low Privilege Logon Allows Compromise of Oracle HRMS (US) Payroll Tax Component |
Wed, 19 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Wed, 19 Aug 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Low Privilege Logon Allows Compromise of Oracle HRMS (US) Payroll Tax Component | |
| Weaknesses | CWE-269 |
Tue, 18 Aug 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | |
| First Time appeared |
Oracle
Oracle hrms |
|
| CPEs | cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle hrms |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-08-18T21:03:30.928Z
Updated: 2026-08-19T16:01:23.360Z
Reserved: 2026-08-04T22:06:34.617Z
Link: CVE-2026-71101
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-08-18T21:18:10.380
Modified: 2026-08-20T13:08:14.613
Link: CVE-2026-71101
Redhat
No data.