EUVD-2026-106109
GHSA-3cqc-cjmc-g4w5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged EBS user
-
ExploitSend crafted HTTP request to Payroll Internal Operations
-
ExecutionSatisfy high-complexity exploit conditions
-
ImpactTake over Oracle Payroll (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Oracle Payroll Internal Operations component on affected versions 12.2.3 through 12.2.15. Oracle rates the flaw 'difficult to exploit' (AC:H), meaning success depends on specific preconditions or circumstances beyond the attacker's direct control rather than a single reliable request. Limiting factors that reduce realistic risk: authentication is mandatory (not remote-unauthenticated), no user interaction is involved but attack complexity is high, and only EBS 12.2.x deployments within the stated range are affected; applying the Oracle CPU October 2026 patch removes the exposure. |
| Impact | This is a genuinely serious but not top-tier-urgent flaw. The CVSS 3.1 base score of 7.5 (High) is driven by full takeover impact (C:H/I:H/A:H) over the network (AV:N) with no user interaction (UI:N), but two metrics materially lower real-world risk: AC:H (Oracle explicitly describes it as 'difficult to exploit,' implying conditions outside the attacker's control) and PR:L (a valid low-privileged Oracle E-Business Suite account is required). No EPSS probability, CISA KEV listing, or public POC was provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. The absence of KEV and POC combined with AC:H suggests this is not currently a mass-exploitation candidate and should be prioritized as part of normal Oracle CPU patching rather than as an emergency. Note a conflict in the metadata: the 'Information Disclosure' tag understates the described impact, which is full takeover of Oracle Payroll (C/I/A all High) - treat impact as full compromise, not mere disclosure. CWE is unspecified (N/A), so the exact weakness class cannot be confirmed. |
| Exploit ScenarioDerived | An attacker holding a valid but low-privileged Oracle E-Business Suite account sends specially crafted HTTP requests to the Internal Operations component of Oracle Payroll. By chaining the conditions required by the high-complexity flaw, the attacker escalates to full compromise of the Payroll module, gaining read/write control over sensitive payroll data and the application itself. No public exploit code is known, and the AC:H rating indicates meaningful effort or specific preconditions are needed to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Takeover of the Oracle Payroll component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for low-privileged attackers who already hold a valid EBS account and can reach the Internal Operations component over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.5), but Oracle rates the flaw difficult to exploit because attack complexity is high and specific preconditions must align. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix for Oracle Payroll in E-Business Suite 12.2.3-12.2.15; the advisory should be consulted for the exact patch set or RU version applicable to each deployment, as a single fix version number is not provided in the available data. Until patching is complete, reduce exposure by restricting network access to the Oracle Payroll Internal Operations endpoints so that only trusted administrative or payroll-integration hosts can reach them, accepting that this may break legitimate remote payroll workflows; audit and minimize low-privileged EBS accounts that can reach Payroll, since PR:L is a documented prerequisite, with the trade-off of additional account-management overhead; and monitor HTTP requests to Payroll internal operations for anomalous access patterns, noting that this is detective rather than preventive. Because the flaw is rated difficult to exploit (AC:H) and no public exploit was identified, emergency out-of-band patching is not indicated, but the October 2026 CPU should be scheduled promptly within normal patch cadence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Internal Operations component of Oracle Payroll, a module of Oracle E-Business Suite that handles payroll processing and related internal workflows over HTTP. Per the CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker needs a valid low-privileged EBS account (PR:L) and network reachability to the Payroll application, and no user interaction is required, but the high attack-complexity rating means exploitation depends on circumstances outside the attacker's direct control rather than a single reliable request. No CWE was supplied with the advisory, so the precise root-cause class (for example, authorization bypass, injection, or unsafe deserialization) is not confirmed from the available data; the impact is a full compromise of the Payroll component's confidentiality, integrity, and availability. Only EBS 12.2.x deployments within the 12.2.3-12.2.15 range are affected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N) but Oracle-stated 'difficult to exploit' (AC:H) and a required low-privileged EBS account (PR:L); full takeover justifies C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
The Oracle E-Business Suite Payroll component (versions 12.2.3 through 12.2.15) has a high-severity vulnerability that could allow a low-privileged user with a valid EBS account and internal HTTP access to compromise payroll confidentiality, integrity, and availability, potentially disrupting payroll operations and eroding employee trust. Leadership should prioritize remediation because payroll is a business-critical function, even though no public exploit identified at time of analysis and Oracle rates exploitation as difficult due to high complexity and specific preconditions.
No vendor-released patch identified at time of analysis; interim mitigations include restricting HTTP access to the Internal Operations component, enforcing least privilege on EBS payroll accounts, monitoring payroll transactions for anomalies, and segmenting the EBS environment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB