What is the CVSS score of CVE-2026-61216?

CVE-2026-61216 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Payroll CVE-2026-61216

EUVD-2026-47415 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-rr5q-66cg-w98c

Denial Of Service Information Disclosure Oracle Payroll

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Oracle-provided vector is consistent with description: network HTTP access, low-privilege authenticated user, partial CIA within unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Payroll accessible data as well as unauthorized read access to a subset of Oracle Payroll accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Payroll. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's flagship enterprise resource planning (ERP) platform, and Oracle Payroll is its payroll processing component handling sensitive compensation and employee financial data. Affected versions span the 12.2.x sustaining engineering release family from 12.2.3 through 12.2.15. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates that the vulnerability is reachable over HTTP with no complexity barrier beyond possessing a valid low-privileged EBS user account. The scope is unchanged (S:U), meaning exploitation is bounded within the Payroll component itself. No CWE was assigned by the reporter, which is typical for Oracle CPU disclosures - Oracle routinely omits root cause classification, making it impossible to determine whether this is an authorization bypass, SQL injection, improper access control, or another class. The specific vulnerable sub-component within the Payroll module is not disclosed in the available data.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026 as the primary remediation; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not published in the available data - reference My Oracle Support (MOS) and the CPU advisory's patch matrix for the applicable patch set identifier for your installed EBS 12.2.x release. As compensating controls prior to patching, enforce strict EBS responsibility assignment so only operationally required users hold Payroll-related responsibilities; audit and prune existing Payroll function grants to reduce the pool of low-privileged users who qualify as attackers under the PR:L condition. Additionally, restrict network-level access to the EBS application tier web services to known internal IP ranges, which raises the practical attacker bar despite not eliminating the vulnerability - note this does not protect against compromised internal accounts. Enable Oracle EBS audit trail logging for Payroll data access and modification to detect exploitation attempts. No workaround details are published by Oracle for this specific CVE.