What is the CVSS score of CVE-2026-61142?

CVE-2026-61142 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Payroll are affected by CVE-2026-61142?

Oracle Payroll in E-Business Suite versions 12.2.3-12.2.15 contains an authorization flaw allowing any authenticated user with system access to read all payroll data, including employee compensation,…

How to fix or mitigate CVE-2026-61142?

Within 24 hours, inventory all Oracle E-Business Suite instances running Payroll versions 12.2.3 through 12.2.15 and restrict HTTP/application-layer network access to Payroll functions using firewall rules or WAF policies; begin forensic review of audit logs for unauthorized Payroll data access. Within 7 days, complete access audit, quantify any unauthorized read events, notify affected employees and compliance teams of exposure scope, and apply the strictest available role-based access controls to limit low-privileged user permissions to Payroll data. Within 30 days, confirm patch availability timeline with Oracle support, evaluate upgrade path to versions beyond 12.2.15, and implement continuous access logging with real-time alerts on anomalous Payroll data queries.

Oracle Payroll CVE-2026-61142

EUVD-2026-47350 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7828-j9cq-4cvq

Authentication Bypass Oracle Payroll

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

HTTP-reachable and low-complexity but needs a valid low-privileged EBS account (PR:L); scope change (S:C) reflects impact to adjacent products; confidentiality-only, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.

Technical ContextAI

Oracle Payroll is a module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP/HCM platform, exposed here through its web (HTTP) tier and the Internal Operations component. The vendor tag 'Authentication Bypass' combined with the CVSS metrics (PR:L, S:C, C:H) indicates an authenticated but low-privileged actor can cross a security boundary to read data they should not reach, extending into other EBS-integrated products. No CWE was assigned in the source data, but the pattern is consistent with a broken access-control / authorization-bypass class (e.g., CWE-284/CWE-639-style horizontal or vertical privilege issues) leading to sensitive information disclosure. The affected code path is reachable over the standard EBS HTTP interfaces used for payroll operations.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input does not state an exact fixed build number, so consult the CPU matrix for the precise patch for your EBS 12.2.x level and apply it across all instances in the 12.2.3-12.2.15 range. As Oracle CPUs are cumulative, install the latest available 12.2 CPU rather than a single one-off patch. Until patching, reduce exposure by restricting network reachability of the EBS/Payroll HTTP tier to trusted internal networks and VPN only, tightening least-privilege on EBS user accounts and payroll responsibilities to shrink the pool of low-privileged accounts that could trigger the flaw, and increasing auditing of payroll data access for anomalous reads. These controls reduce reachability and improve detection but do not remove the vulnerability, and over-restricting responsibilities may disrupt legitimate payroll operations, so validate changes before enforcing.