CVE-2026-46953: Oracle HRMS (UK) Payroll System Takeover Vulnerability – Severity 7.2

Technical summary

CVE-2026-46953 is an improper access control vulnerability (CWE-269) in Oracle HRMS (UK) UK Payroll component. The vulnerability requires high privilege (PR:H) but no attack complexity or user interaction (AC:L, UI:N), and is remotely exploitable via HTTP. The CVSS 3.1 score of 7.2 reflects high impact across confidentiality, integrity, and availability—indicating an attacker can read, modify, or delete data and disrupt service. Affected versions span 12.2.3 through 12.2.15 of Oracle E-Business Suite.

Business impact

Compromise of HRMS (UK) creates severe business continuity and compliance risks. Payroll processing could be halted or corrupted, affecting employee compensation delivery. Sensitive personal data (SSNs, banking, tax information) and financial records become accessible to attackers. UK organizations face regulatory exposure under GDPR and employment law. Reputational damage and potential litigation follow data breaches involving payroll systems. The system's role in financial controls also creates audit and SOX compliance concerns.

Affected systems

Oracle E-Business Suite deployments running HRMS (UK) with payroll functionality, specifically versions 12.2.3 through 12.2.15. Organizations in the UK and those using UK payroll processing with these E-Business Suite releases are affected. Legacy versions within the 12.2.x line remain vulnerable until patched.

Exploitability

Exploitability is limited by the requirement for high-privilege credentials—the attacker must already possess administrative or near-administrative access to the system. However, the absence of attack complexity (AC:L) and the network-accessible nature (AV:N) mean that once a privileged account is compromised or a malicious insider acts, exploitation is straightforward and reliable. This is not a zero-click or unauthenticated attack, but a significant insider threat vector and a stepping stone for lateral movement in compromised environments.

Remediation

Apply the vendor patch from Oracle's Critical Patch Update (CPU) when released. Until patches are available, implement network-level access controls to restrict HTTP access to HRMS (UK) to trusted administrator networks only. Enforce multi-factor authentication for all administrative accounts accessing E-Business Suite. Monitor and audit high-privilege user activity on payroll-related functions. Consider temporarily restricting administrative access to the payroll module for non-essential users.

Patch guidance

Consult Oracle's official Critical Patch Update advisory for June 2026 (or the applicable CPU cycle) for exact patch versions and installation steps specific to your E-Business Suite release. Patches for 12.2.x versions should be tested in a pre-production environment before deployment to payroll systems. Verify patch applicability against your exact version number (12.2.3–12.2.15 are affected) and apply according to Oracle's documented maintenance procedures. Document the patch application in your change management and security logs.

Detection guidance

Monitor HRMS (UK) web server logs for unusual HTTP requests originating from administrative users, particularly those accessing payroll-related endpoints or configuration functions. Alert on any authentication changes to high-privilege accounts in HRMS (UK). Track modifications to payroll data, employee records, or system settings made by administrators outside normal change windows. Use user and entity behavior analytics (UEBA) to detect anomalous administrative activity. Enable audit logging in E-Business Suite and review logs for privilege escalation or unusual data access patterns within the payroll module.

Why prioritize this

This vulnerability should be prioritized for any organization running the affected HRMS (UK) versions due to the high CVSS score (7.2) and broad impact on confidentiality, integrity, and availability. The insider threat context—high-privilege requirement—means your security posture depends heavily on administrator account hygiene and network segmentation. UK organizations face additional regulatory urgency due to data protection and employment law obligations. Payroll systems are often targeted by attackers and insiders; compromise directly threatens employee welfare and organizational stability.

Risk score, explained

The CVSS 3.1 base score of 7.2 (HIGH) reflects three factors: (1) Network accessibility (AV:N) broadens potential attack surface; (2) Low attack complexity (AC:L) and no user interaction (UI:N) mean exploitation is reliable once a privileged account is obtained; (3) Full impact across confidentiality, integrity, and availability (C:H, I:H, A:H) indicates complete system compromise. The high-privilege requirement (PR:H) prevents a 9.0+ score but does not mitigate the severity—privileged accounts are frequent targets and insider threats. Environmental factors (data sensitivity, regulatory obligations) should raise priority further in your risk assessment.

Frequently asked questions