EUVD-2026-47170
GHSA-96v4-4g3r-33q3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Payroll HTTP interface
-
ExploitSend crafted requests meeting AC:H conditions
-
ExecutionExploit Internal Operations flaw
-
PersistTake over Oracle Payroll application
-
ImpactAccess/alter payroll and PII data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated session on Oracle E-Business Suite (CVSS PR:L) with HTTP network reachability to the Payroll/Internal Operations web tier; no end-user interaction is needed (UI:N). Limiting factors: attack complexity is High (AC:H), meaning success depends on conditions outside the attacker's direct control or a non-trivial exploitation sequence, and the attacker must already hold application credentials - this is not remote-unauthenticated. Affected deployments are constrained to EBS 12.2.3-12.2.15 running the Oracle Payroll module; environments without Payroll provisioned or without exposed EBS web access to low-privileged users are not exploitable. |
| Impact | The signals are mixed and lean toward a real-but-not-urgent priority. CVSS 3.1 is 7.5 (High), and the vector shows a network vector (AV:N) with no user interaction (UI:N), which raises exposure; however AC:H (high attack complexity) and PR:L (requires an authenticated low-privileged account) materially reduce the population of capable attackers and the likelihood of mass exploitation. No EPSS score was provided, the CWE is unspecified, there is no POC and no CISA KEV listing, so there is no evidence of active or automatable exploitation at this time. The 'Information Disclosure' vendor tag conflicts somewhat with the assigned high integrity and availability impacts (which imply takeover, not mere disclosure) - this discrepancy should be verified against Oracle's advisory. Net: treat as an important patch-cycle item (privileged ERP with sensitive payroll/PII data) rather than an emergency, given the authentication and complexity barriers. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privileged Oracle EBS application account sends crafted HTTP requests to the Payroll/Internal Operations interface and, after working around the high-complexity conditions, escalates to full control of the Oracle Payroll application, reading and altering sensitive payroll and PII data. No public exploit is identified at time of analysis, and the AC:H rating means a reliable attack requires specific conditions or effort rather than a simple one-shot request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update - patch available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a discrete fixed build number in this entry, so identify the specific EBS 12.2 patch/RUP for your release (12.2.3-12.2.15) via the CPU patch matrix and My Oracle Support. Because exploitation requires an authenticated low-privileged session over HTTP, compensating controls while patching include restricting network access to the EBS web tier to trusted networks/VPN, tightening Payroll and Internal Operations responsibility/role assignments to remove unnecessary low-privilege accounts, enforcing strong authentication and session controls, and monitoring EBS access logs for anomalous Payroll activity; note these controls reduce but do not eliminate risk from legitimate internal accounts and do not substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite (EBS) is Oracle's on-premises enterprise resource planning (ERP) suite; the affected element is the Oracle Payroll product within the Internal Operations component, exposed over HTTP as part of the EBS web tier. The CWE is not published by Oracle (CWE N/A), which is typical of Oracle Critical Patch Update entries that describe impact rather than root-cause class; the vendor tag 'Information Disclosure' hints at a data-exposure vector, though the assigned CVSS indicates the flaw escalates to full C/I/A takeover rather than disclosure alone. Because EBS 12.2.x runs on the Oracle Application Server / WebLogic-based middle tier with a shared authentication model, an authenticated application session (PR:L) is the entry point, and the unchanged scope (S:U) means impact is contained to the Payroll application context.
Know when Payroll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach with no UI (AV:N/UI:N); requires an authenticated low-privileged EBS account (PR:L) and non-trivial conditions (AC:H); full application takeover gives C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Payroll (E-Business Suite v12.2.3-12.2.15) is vulnerable to complete application compromise by low-privileged attackers with network access, enabling unauthorized access to sensitive payroll data and processing controls. Organizations running affected versions face risk of payroll fraud, unauthorized data exfiltration, and regulatory compliance violations affecting employee compensation and tax reporting.
No vendor-released patch identified at time of analysis. Implement network access controls (firewall, IP whitelisting, network segmentation) to restrict HTTP connectivity to Payroll module to authorized administrative personnel only; enforce multi-factor authentication for all Payroll users; disable the module if not in active use; implement enhanced application logging and alerting for all authentication attempts and data modifications within Payroll; and conduct quarterly security assessments of Payroll module configuration and access logs until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged,
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), ver
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Exploit-DB