Oracle Payroll CVE-2026-101709

Exploitation requires an authenticated low-privilege account on Oracle Payroll within Oracle E-Business Suite (PR:L - not remote-unauthenticated) and the Internal Operations component must be reachable over HTTP. Critically, the attack cannot complete without human interaction from a different user (UI:R): a separate victim, typically one with greater privileges or context, must be induced to perform an action, which makes this effectively a social-engineering/CSRF-style chain rather than a direct single-actor exploit. Limiting factors that reduce realistic risk: valid credentials are mandatory, a second human must cooperate unknowingly, and only EBS versions 12.2.3 through 12.2.15 are affected. The elevating factor is the scope change (S:C), where successful exploitation 'may significantly impact additional products' beyond Payroll in the same EBS environment.

This is a moderate-severity, medium-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 base score is 5.4 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N: network-reachable over HTTP with low attack complexity, but it is NOT unauthenticated - PR:L means the attacker needs an existing low-privilege Oracle Payroll/EBS account, and UI:R means a separate victim must be induced to act. Both of these materially reduce real-world exploitability versus a drive-by remote flaw. The partial confidentiality and integrity impacts (C:L/I:L) with no availability impact (A:N) indicate limited data read plus limited unauthorized update/insert/delete, not full compromise. The one elevating factor is Scope:Changed - Oracle states attacks 'may significantly impact additional products,' so blast radius can extend beyond Payroll into the broader EBS deployment. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the authentication-plus-user-interaction requirement further argues against opportunistic mass exploitation. One data conflict must be flagged: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L and the description's explicit 'low privileged attacker' - this is not an auth-bypass flaw, so that tag appears mislabeled and should not drive prioritization.

A low-privileged but authenticated Oracle Payroll user plants a crafted request or payload in an Internal Operations workflow and then lures a higher-context user into viewing or acting on it (the required human interaction). When the victim acts, the attacker gains limited unauthorized read of Payroll data and the ability to update, insert, or delete some Payroll records, with the scope change potentially carrying impact into other connected Oracle E-Business Suite products. No public exploit code was identified at the time of analysis, and low attack complexity (AC:L) means execution is straightforward once the account and victim interaction are available.