Oracle Payroll CVE-2026-46826

Attacker must hold valid credentials for any low-privileged Oracle E-Business Suite account (PR:L) and must be able to reach the EBS web tier over HTTPS (AV:N) - typically the Oracle HTTP Server fronting Payroll's Internal Operations component on EBS 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so no race conditions, specific timing, or unusual configuration are needed. Limiting factors: the target must be running an affected 12.2.x release of EBS with the Payroll module deployed and enabled, the attacker needs network reachability to the EBS apps tier (commonly internal-only in well-segmented deployments), and an existing authenticated account is mandatory - fully anonymous exploitation is not indicated by the CVSS vector.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) classes this as high-severity with easy network exploitation by any low-privileged user - a meaningful bar in EBS environments where self-service portals routinely grant employees authenticated access. EPSS and KEV data were not provided in the input, so probability of mass exploitation and confirmed in-the-wild use are unknown; no public exploit identified at time of analysis. Oracle's own description characterizes the bug as 'easily exploitable' resulting in 'takeover of Oracle Payroll,' which combined with the sensitivity of payroll data (PII, banking details, tax IDs) makes this a real priority for any organization running EBS 12.2.x, not merely a paper-high CVSS. Note that PR:L means an authenticated foothold is required - risk is materially higher where Payroll/EBS is internet-exposed or where employee self-service accounts are broadly provisioned.

An attacker who has phished or otherwise obtained any low-privileged EBS account (for example, a standard employee self-service login) authenticates to the EBS HTTPS web tier and issues a crafted request against an Internal Operations endpoint of the Payroll module, gaining the ability to read, alter, or destroy payroll records, banking details, and tax data. Because UI:N applies, no second user must be tricked into clicking anything; one valid session is enough. No public exploit identified at time of analysis, so weaponization timeline is uncertain but historically EBS bugs see proof-of-concept activity within weeks of CPU disclosure.