Oracle Payroll CVE-2026-60897

Exploitation requires network access to the HTTP interface of the Oracle Payroll 'Internal Operations' component in Oracle E-Business Suite 12.2.3-12.2.15, plus a valid low-privileged EBS session (CVSS PR:L - the attacker must be authenticated at a low level, not anonymous). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privileged Payroll-reachable account there are no additional special configuration prerequisites documented by Oracle. Limiting factors: the need for prior authentication and network reachability to the Payroll web tier; environments that isolate EBS behind VPN/internal-only networks and strictly limit low-privilege account provisioning materially reduce realistic exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) signals a genuinely serious, network-reachable issue: low attack complexity, no user interaction, and only low privileges required, with full impact to confidentiality, integrity, and availability. Oracle explicitly labels it 'easily exploitable,' which reinforces the AC:L/UI:N metrics. However, mitigating real-world signals: it is NOT in CISA KEV (no confirmed active exploitation), no POC or exploit code is referenced, and no EPSS score was provided, so exploitation probability cannot be quantified. The PR:L requirement means an attacker must first hold at least a low-privileged/authenticated EBS session, which limits fully anonymous internet-wide attack but is a low bar for insiders or attackers who have phished or reused credentials. Net: a real priority to patch for organizations running EBS 12.2.x, but not confirmed as under mass exploitation - treat as high priority driven by ease-of-exploit and impact rather than by observed in-the-wild activity.

An attacker who has obtained a low-privileged Oracle EBS account - via credential phishing, reuse, or an insider - sends crafted HTTP requests to the Payroll Internal Operations interface and escalates to full control of the Payroll module, reading or altering sensitive payroll and personnel data. Given AC:L and UI:N, no victim interaction or complex timing is needed, making the attack straightforward once network and session access exist. No public POC is currently referenced, so this scenario is inferred from the CVSS vector rather than a demonstrated exploit.