EUVD-2026-46758
GHSA-gg2w-h77r-4qxp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible payroll endpoint requires only a low-privileged EBS account (PR:L); no availability impact and unchanged scope confirmed by description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (France) accessible data as well as unauthorized read access to a subset of Oracle HRMS (France) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.
Technical ContextAI
Oracle HRMS (France) is a country-localized payroll and human resources module within Oracle E-Business Suite (EBS) 12.2.x, specifically engineered to handle French labor law compliance, payslip generation, and payroll processing via an HTTP-accessible web application layer. The vulnerability resides in the French HR Payroll sub-component (EUVD-2026-46758), which is exposed over HTTP as part of the broader EBS web tier. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates a straightforward network-reachable flaw with low access complexity. Although the NVD lists CWE as N/A, the 'Authentication Bypass' tag provided in multi-source intelligence points to a broken access control or improper authorization enforcement pattern - a low-privileged user's HTTP requests are processed without adequate role or permission verification against the payroll data scope. The affected version range (12.2.3-12.2.15) spans multiple years of EBS 12.2 releases, indicating a long-standing architectural flaw in the France localization layer.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which contains the official fix for this vulnerability within Oracle E-Business Suite 12.2.x. Oracle's CPU documentation should be consulted for the specific patch set number applicable to each 12.2.x sub-release, as Oracle does not publish individual patched version strings externally. As a compensating control prior to patching, restrict HTTP access to the French HR Payroll component using Oracle EBS Function Security and Menu exclusions to limit which authenticated users can reach the affected payroll functions - note this reduces but does not eliminate exposure if the bypass affects the underlying data layer. Network-layer controls (WAF rules or firewall restrictions) limiting HTTP access to the EBS application to only authorized IP ranges can further reduce the attack surface, though these controls do not remediate the authorization flaw itself. Audit all low-privileged EBS user accounts to identify and remove unnecessary assignments to France HRMS responsibilities.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 throug
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) a
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network at
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Inter
Local privilege escalation in Oracle HRMS (US), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HR
Unauthenticated data disclosure in Oracle HRMS (US) US Payroll module of Oracle E-Business Suite 12.2.7 through 12.2.15
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today