Oracle Payroll CVE-2026-61216

Exploitation requires a valid Oracle E-Business Suite user account with at least low-privilege access (PR:L) and HTTP network reachability to the EBS application tier - an authenticated insider or compromised EBS account satisfies this requirement. No user interaction from a victim or administrator is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special sequencing is needed. Exploitation is limited to Oracle EBS installations running versions 12.2.3 through 12.2.15; versions outside this range are not confirmed affected. Because Oracle CPU advisories do not disclose the specific Payroll sub-component or required configuration, it is not confirmed whether a particular EBS responsibility, workflow, or non-default feature must be active beyond a standard Oracle Payroll deployment. Limiting factors include the authentication requirement (unauthenticated external attackers without EBS credentials cannot exploit this), the unchanged scope (exploitation impact is bounded to Oracle Payroll data, not the underlying OS or database), and the partial nature of all three impacts.

The CVSS 3.1 score of 6.3 (Medium) accurately reflects the limited blast radius: all three CIA impacts are partial (C:L/I:L/A:L) within an unchanged scope, and exploitation requires a low-privileged but authenticated user. Oracle's explicit characterization of this as 'easily exploitable' is significant - AV:N/AC:L/PR:L/UI:N means any authenticated EBS user with HTTP access to the application tier could trigger the flaw without specialized knowledge. No EPSS data was provided in the input, preventing a probabilistic exploitation likelihood assessment. KEV status is negative and no POC has been identified, both pointing away from active threat actor interest at this time. The primary practical risk is an insider threat - a disgruntled payroll clerk, auditor, or compromised low-privilege account - who reads payroll records outside their authorization, manipulates compensation data, or disrupts payroll runs. The absence of CWE classification is a data gap that limits precise risk modeling; defenders cannot determine whether SQL injection mitigations or specific access control configurations would reduce exposure.

A low-privileged Oracle EBS user - such as a payroll data entry operator or HR administrator - submits crafted HTTP requests to the Oracle Payroll component, exploiting the vulnerability to read payroll records for employees outside their authorization scope, alter salary or deduction records they should not modify, or trigger processing errors that partially disrupt payroll run availability. No public proof-of-concept has been identified, so the precise request format is unknown; however, Oracle's 'easily exploitable' classification and the AC:L vector indicate that exploitation would not require specialized tooling beyond standard HTTP access to the EBS interface.