Oracle Payroll CVE-2026-60750

Exploitation requires the attacker to already hold a valid low-privilege Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the EBS application tier hosting the Oracle Payroll Internal Operations component, on a supported version between 12.2.3 and 12.2.15. No user interaction and no high privileges are needed, and attack complexity is low, so any authenticated low-privilege user who can reach the Payroll HTTP interface can attempt it. Limiting factors: the requirement for a valid authenticated account (this is not a pre-authentication remote attack despite the 'Authentication Bypass' tag), reachability of the EBS/Payroll HTTP endpoint (mitigated where the app tier is not internet-exposed), and the affected version window - deployments outside 12.2.3-12.2.15 or already on the July 2026 CPU are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 High) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change amplifying impact across products - a serious profile for an internal or credentialed threat actor. However, exploitation is not fully unauthenticated: PR:L means the attacker needs a valid low-privilege EBS account, which meaningfully limits opportunistic external exploitation. No EPSS score was provided in the input and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC has been identified. Note a tension in the source data: the vendor tag 'Authentication Bypass' suggests circumventing authentication, yet the CVSS vector encodes PR:L (a privilege is required) - treat the 'bypass' as authorization/entitlement bypass by an already-authenticated user, not pre-auth access, and verify against Oracle's advisory. Overall this is a real priority for organizations running EBS Payroll where many users hold low-privilege accounts, but the required authentication and absence of exploitation signals place it below internet-facing unauthenticated critical flaws.

A user holding an ordinary low-privilege Oracle EBS account (for example an employee self-service or junior HR login) sends crafted HTTP requests to the Payroll Internal Operations component and, exploiting the authorization weakness, reads payroll data they are not entitled to and - via the scope change - sensitive data from other EBS modules. Because attack complexity is low and no user interaction is needed, the attack is repeatable and scriptable; no public POC has been identified at time of analysis.