Oracle Payroll CVE-2026-46828

Exploitation requires (1) network reachability over HTTP/HTTPS to an Oracle E-Business Suite instance running the Payroll module, specifically the Internal Operations component, on a supported version between 12.2.3 and 12.2.15, and (2) valid credentials for any low-privilege EBS account (PR:L) - full Payroll administrator rights are not needed. No user interaction and no special non-default configuration are called out by Oracle, so any standard deployment that has Payroll enabled and HTTP-exposed to its user base is in scope. Limiting factors: EBS instances that are strictly internal-network-only restrict the attacker population to insiders or anyone with foothold on the corporate network, and environments that do not license/enable the Payroll module are not exposed.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) signals a genuinely dangerous condition: remotely reachable over HTTP, low complexity, only a low-privilege account required, no user interaction, and high confidentiality and integrity impact (availability is untouched). This is meaningful in EBS environments where 'low-privilege' often means any authenticated employee or self-service user - a very large internal population. Offsetting signals: there is no EPSS score, no SSVC decision data, no POC, and no CISA KEV listing supplied, so this is currently a high-CVSS issue without confirmed in-the-wild exploitation. The 'Authentication Bypass' tag is a notable signal that conflicts slightly with the PR:L vector - verify with Oracle whether some attack paths are fully pre-auth, as that would materially increase urgency. For organizations running EBS 12.2.x with Payroll exposed beyond the corporate network or to broad user bases, this should be treated as a high-priority CPU patch; for tightly segmented internal-only deployments, normal CPU cadence is reasonable.

An attacker who has obtained credentials for any low-privilege Oracle EBS account - for example a self-service employee login, a phished HR clerk, or a contractor account - sends crafted HTTP requests to the Payroll Internal Operations component and is able to read sensitive payroll records (salaries, bank account numbers, tax IDs) and tamper with payroll data such as direct-deposit destinations or pay rates. No user interaction is required and complexity is low, making it well-suited to insider abuse or post-credential-compromise lateral escalation; no public exploit identified at time of analysis.