What is the CVSS score of CVE-2026-60890?

CVE-2026-60890 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Payroll are affected by CVE-2026-60890?

Oracle Payroll module in E-Business Suite versions 12.2.3-12.2.15 can be completely compromised by low-privileged authenticated users, exposing all payroll data and enabling unauthorized…

How to fix or mitigate CVE-2026-60890?

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3-12.2.15 and restrict access to the Payroll module to only essential administrative staff to reduce exposure. Within 7 days, apply the Oracle Critical Patch Update released in July 2026 to all affected systems. Within 30 days, verify patch deployment completeness, conduct audit trail review for unauthorized access attempts, and implement monitoring of Payroll module transaction activity.

Oracle Payroll CVE-2026-60890

EUVD-2026-47166 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-8858-xwr2-vv2x

Privilege Escalation Oracle Payroll

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, but a low-privileged EBS account is required (PR:L), and full component takeover gives C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:38 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Payroll is a module of Oracle E-Business Suite (EBS), a large web-based ERP platform typically fronted by Oracle Application Server/HTTP Server and backed by an Oracle Database. The affected 'Internal Operations' sub-component is reachable over HTTP within the authenticated EBS application context. Oracle does not publish CWE or granular root-cause detail for CPU entries, and no CWE was provided here; based on the impact profile (low-privilege authenticated user escalating to full component takeover) the class is consistent with authorization/access-control weaknesses or injection into a privileged operation, but the exact root cause is not documented in the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; Oracle addresses EBS Payroll issues via CPU-bundled patches rather than a single standalone version, so administrators should identify and apply the specific patch for their EBS 12.2 release level as listed in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - no standalone fixed build number was provided in this data). Until patching is complete, reduce exposure by restricting network access to the EBS application tier and the Payroll/Internal Operations endpoints to trusted internal networks or VPN, tightening provisioning so that low-privileged accounts are minimized and reviewed (since PR:L means any low-privilege user is a potential attacker), and increasing monitoring of Payroll module activity; note these controls reduce but do not eliminate risk from insider or already-authenticated accounts and may disrupt legitimate remote users.