Oracle Payroll CVE-2026-101712

Exploitation requires a pre-existing low-privilege authenticated account on the Oracle E-Business Suite instance (PR:L) and HTTP network reachability to the Oracle Payroll Internal Operations component. The high attack complexity (AC:H, Oracle's 'difficult to exploit') indicates additional non-default preconditions such as specific timing, server state, or configuration must be met, so exploitation is not reliably repeatable against an arbitrary target. Limiting factors: the authentication prerequisite rules out fully anonymous attackers, and the vulnerability is confined to EBS versions 12.2.3 through 12.2.15 running the Payroll module; no user interaction is required (UI:N).

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.5 is driven by full confidentiality, integrity and availability impact (C:H/I:H/A:H, 'takeover of Oracle Payroll'), but two vector metrics temper real-world risk: AC:H (Oracle's own 'difficult to exploit' language, implying race conditions, specific state, or non-trivial preconditions) and PR:L (the attacker must already hold a low-privilege authenticated account on the EBS instance). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent mass exploitation. The signals are internally consistent - network vector matches the HTTP delivery described, and PR:L matches the 'low privileged attacker' wording - so no metric conflicts need flagging. Net assessment: patch in the normal Oracle CPU cycle; the authentication requirement and high attack complexity make opportunistic internet-wide exploitation unlikely, but a motivated insider or an attacker who has already phished a low-privilege EBS account could achieve full module compromise. EPSS/KEV/POC data being absent is itself a gap - it cannot be read as 'low risk,' only as 'no exploitation evidence available.'

An attacker who has obtained a low-privilege authenticated account on an internet- or intranet-exposed Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Payroll Internal Operations component to exploit the flaw. Because the attack complexity is high, the attacker likely must meet specific timing or state conditions, but a successful attack yields complete takeover of the Payroll module. No public exploit code is identified at time of analysis.