What is the CVSS score of CVE-2026-60897?

CVE-2026-60897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Payroll are affected by CVE-2026-60897?

Oracle Payroll (EBS 12.2.3-12.2.15) can be fully compromised by authenticated low-privilege users exploiting CVE-2026-60897, creating material risk to payroll processing, employee data integrity, and…

How to fix or mitigate CVE-2026-60897?

Within 24 hours: inventory all Oracle EBS instances in the affected versions (12.2.3-12.2.15) and confirm which run Payroll components; assess network exposure and document low-privilege user counts with payroll system access. Within 7 days: implement network access controls restricting HTTP/HTTPS requests to payroll modules to defined IP ranges, enable detailed audit logging of payroll transaction processing, and reduce low-privilege account privileges where operationally feasible. Within 30 days: monitor vendor advisories for available patches; if no patch is released, plan upgrade to EBS 12.2.16 or later, or evaluate compensating controls with database-level encryption and additional HTTP request filtering.

Oracle Payroll CVE-2026-60897

EUVD-2026-47172 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-5q4q-8q5g-cgx2

Privilege Escalation Oracle Payroll

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP interface (AV:N) with low complexity and no interaction, but requires an authenticated low-privileged session (PR:L); vendor states full Payroll takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:37 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.

Technical ContextAI

Oracle Payroll is a module of Oracle E-Business Suite (EBS), a large enterprise ERP/HCM platform typically deployed as a multi-tier Java/PL-SQL web application fronted by Oracle HTTP Server and backed by an Oracle Database. The vulnerable 'Internal Operations' component is reached over HTTP, indicating the issue lies in a network-exposed application interface rather than a backend batch process. Oracle did not assign a CWE (CWE: N/A) and does not disclose root-cause detail in CPU advisories, so the precise weakness class (e.g., injection, access control, or deserialization) cannot be determined from the available data; the 'Information Disclosure' tag plus C:H/I:H/A:H impact suggests a flaw that leaks data and also permits state modification, consistent with a broken access-control or injection defect.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update, which is the vendor-released patch for this issue; see https://www.oracle.com/security-alerts/cpujul2026.html for the exact EBS 12.2 patch bundle applicable to your release (Oracle ships this as CPU patch sets rather than a single incremental version number, so the specific released patched version is not independently confirmed here beyond the CPU). Because exploitation is over HTTP and requires only low privileges, until patching is complete restrict network access to the EBS/Payroll web tier to trusted internal networks and VPNs, place the application behind a WAF or reverse proxy to filter anomalous requests to Internal Operations endpoints, and tighten Payroll application-role assignments to minimize the population of low-privileged accounts that could reach the vulnerable component. These controls reduce exposure but do not remove the flaw and may impact legitimate remote users of the Payroll self-service interfaces, so schedule the CPU as the durable remediation.