Oracle Payroll CVE-2026-60893

Exploitation requires an active local logon session on the infrastructure host where Oracle Payroll executes - this is not remotely exploitable without a prior foothold. The attacker must hold a low-privileged OS-level account (PR:L) on that host; no higher privilege is required. No specific non-default configuration is identified as a prerequisite. Exploitation is limited by the local attack vector: an attacker without any form of shell or session access to the Oracle Payroll host cannot exploit this vulnerability remotely. Additionally, Oracle Payroll must be running versions 12.2.3 through 12.2.15; installations outside this range or on 12.1.x are not listed as affected. The 'Authentication Bypass' tag indicates that once local access is achieved, Oracle Payroll's own internal authorization layer can be circumvented without needing Oracle application-level credentials or Payroll-specific roles.

The CVSS 3.1 base score of 6.5 accurately reflects the local attack vector constraint - this is not remotely exploitable without first obtaining a foothold on the Oracle Payroll host, which significantly limits opportunistic internet-scale attacks. However, in enterprise environments where Oracle EBS runs on shared infrastructure (managed services, virtualized tenants, contractor-accessible servers), the PR:L requirement is a realistic bar that is frequently met by service accounts, DBA staff, or infrastructure operators. The Scope:Changed and C:H combination elevates practical risk: full read access to payroll data (salaries, PII, tax records) across an organization is a high-value exfiltration target. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed. The 'Authentication Bypass' tag conflicts somewhat with PR:L - PR:L implies some authentication is required, yet the tag suggests internal controls are bypassed after that initial access. This is best interpreted as: OS-level logon (PR:L) is the entry gate, but Oracle Payroll's own authorization layer is then bypassed. EPSS data is absent, so exploitation probability cannot be quantified numerically; the 'easily exploitable' Oracle language and AC:L/UI:N metrics suggest low technical barrier once local access is obtained.

An attacker who has obtained a low-privileged OS account on the Oracle EBS application server - via credential theft, insider access, or lateral movement from a compromised adjacent system - logs into the host and invokes Oracle Payroll's Internal Operations interfaces, bypassing the product's internal authorization controls to extract the full contents of payroll data including employee salaries, tax identifiers, and banking details. No public proof-of-concept code has been identified at time of analysis, but Oracle's characterization of the issue as 'easily exploitable' with AC:L/UI:N suggests that exploitation would be straightforward once local access is established.