What is the CVSS score of CVE-2026-60750?

CVE-2026-60750 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Payroll are affected by CVE-2026-60750?

An authentication bypass in Oracle Payroll (E-Business Suite versions 12.2.3-12.2.15) with scope escalation allows low-privilege users to read sensitive payroll data and compromise connected systems.

How to fix or mitigate CVE-2026-60750?

Within 24 hours, inventory all Oracle E-Business Suite deployments to identify instances running versions 12.2.3-12.2.15 and assess which systems have active low-privilege users with payroll module access. Within 7 days, implement access controls restricting low-privilege payroll data reads (disable unnecessary low-privilege payroll roles, enforce group-based access policies, and enable detailed audit logging on payroll data access). Within 30 days, work with Oracle support to identify available options-including interim patches through support channels, upgrade paths to post-12.2.15 versions, or extended maintenance guidance-while maintaining the compensating controls as indefinite safeguards until a permanent fix is deployed.

Oracle Payroll CVE-2026-60750

EUVD-2026-47081 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cccf-3jpj-hgw6

Authentication Bypass Oracle Payroll

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Authenticated low-privilege user over HTTP (PR:L, AV:N, AC:L) bypasses authorization to read data across a scope boundary (S:C, C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.

Technical ContextAI

Oracle Payroll is a module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, exposed over HTTP through the EBS application tier. The affected 'Internal Operations' component handles back-end payroll processing and inter-module data flows. The CVSS scope change (S:C) indicates the vulnerable Payroll code can breach the security authorization boundary and expose data belonging to other EBS products sharing the same environment, consistent with EBS's shared middle-tier and database architecture. No CWE was assigned by NVD or Oracle, but the vendor-supplied tag 'Authentication Bypass' combined with a pure confidentiality (C:H/I:N/A:N) profile points to a broken access-control or improper-authorization root cause that lets an authenticated user reach data beyond their entitlement rather than a memory-corruption or code-execution flaw.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and only vendor-sanctioned remediation for the affected 12.2.3-12.2.15 range; the input does not specify an exact patched build number beyond the CPU, so consult the CPU patch matrix for the precise EBS 12.2 patch level (Patch available per vendor advisory). Until the CPU is applied, reduce exposure by restricting network access to the EBS application tier and Payroll HTTP endpoints to trusted internal networks and VPN users, tightening EBS responsibility and role assignments so low-privilege accounts cannot reach Payroll Internal Operations functions, and increasing monitoring of Payroll data-access audit logs - with the trade-off that endpoint and responsibility restrictions can disrupt legitimate self-service or HR users and are only compensating controls, not a substitute for patching. Because exploitation requires a valid low-privilege account, promptly reviewing and de-provisioning stale or over-broad user accounts is a high-value interim measure.