Oracle Payroll CVE-2026-60890

Exploitation requires the attacker to already hold a valid low-privileged Oracle E-Business Suite account (CVSS PR:L, authenticated) with HTTP network access to the Payroll application tier, and the target must be running an affected EBS release in the 12.2.3-12.2.15 range with the Payroll module (Internal Operations component) deployed. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a foothold account exists, exploitation is straightforward. The limiting factors are the authentication requirement (not exploitable by a fully anonymous external attacker) and network reachability of the EBS Payroll endpoints, which in well-segmented deployments are internal-only.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total impact to the component - a strong prioritization signal, reinforced by Oracle's own 'easily exploitable' language. However, the exploitation is gated by PR:L: the attacker needs a valid, if low-privileged, EBS account, which limits purely external opportunistic attack. No EPSS score, KEV listing, or POC was provided, so real-world exploitation likelihood cannot be quantified from this data; the tag 'Information Disclosure' partially conflicts with the CIA-triple 'takeover' description, suggesting the tag understates the true impact - treat the CVSS/description impact (full takeover) as authoritative. Overall this is a genuine high priority for organizations running EBS, tempered by the authentication requirement and the absence of any confirmed exploitation.

A user holding a low-privilege Oracle EBS account (for example a standard employee self-service login) sends crafted HTTP requests to the Payroll Internal Operations component and abuses the flaw to escalate to full control of the Payroll module, reading and altering sensitive payroll and PII data. Because attack complexity is low and no user interaction is needed, a single authenticated session is sufficient; no public POC has been identified at time of analysis.