What is the CVSS score of CVE-2026-60894?

CVE-2026-60894 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Payroll are affected by CVE-2026-60894?

Oracle Payroll (E-Business Suite v12.2.3-12.2.15) is vulnerable to complete application compromise by low-privileged attackers with network access, enabling unauthorized access to sensitive payroll…

How to fix or mitigate CVE-2026-60894?

Within 24 hours: audit all Oracle E-Business Suite deployments to identify instances running Payroll module versions 12.2.3 through 12.2.15 and inventory network accessibility. Within 7 days: implement firewall rules restricting HTTP access to the Payroll module to authorized administrators only; enable network segmentation and IP whitelisting; enforce multi-factor authentication for all Payroll module user accounts; and disable the Payroll module entirely if operationally feasible. Within 30 days: monitor Oracle security advisories and engage Oracle support to confirm patch availability and compatibility; prepare and test upgrade to a patched version of Oracle E-Business Suite; conduct enhanced logging and alerting on Payroll module authentication and data access.

Oracle Payroll CVE-2026-60894

EUVD-2026-47170 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-96v4-4g3r-33q3

Privilege Escalation Oracle Payroll

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reach with no UI (AV:N/UI:N); requires an authenticated low-privileged EBS account (PR:L) and non-trivial conditions (AC:H); full application takeover gives C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:39 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's on-premises enterprise resource planning (ERP) suite; the affected element is the Oracle Payroll product within the Internal Operations component, exposed over HTTP as part of the EBS web tier. The CWE is not published by Oracle (CWE N/A), which is typical of Oracle Critical Patch Update entries that describe impact rather than root-cause class; the vendor tag 'Information Disclosure' hints at a data-exposure vector, though the assigned CVSS indicates the flaw escalates to full C/I/A takeover rather than disclosure alone. Because EBS 12.2.x runs on the Oracle Application Server / WebLogic-based middle tier with a shared authentication model, an authenticated application session (PR:L) is the entry point, and the unchanged scope (S:U) means impact is contained to the Payroll application context.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update - patch available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a discrete fixed build number in this entry, so identify the specific EBS 12.2 patch/RUP for your release (12.2.3-12.2.15) via the CPU patch matrix and My Oracle Support. Because exploitation requires an authenticated low-privileged session over HTTP, compensating controls while patching include restricting network access to the EBS web tier to trusted networks/VPN, tightening Payroll and Internal Operations responsibility/role assignments to remove unnecessary low-privilege accounts, enforcing strong authentication and session controls, and monitoring EBS access logs for anomalous Payroll activity; note these controls reduce but do not eliminate risk from legitimate internal accounts and do not substitute for the CPU patch.