What is the CVSS score of CVE-2026-61250?

CVE-2026-61250 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Payroll CVE-2026-61250

EUVD-2026-47439 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hxfg-2cv7-vp99

Authentication Bypass Oracle Payroll

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible via HTTP, low complexity, low-privilege auth required (PR:L); confidentiality impact only with no integrity or availability effect, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.

Technical ContextAI

Oracle Payroll is the payroll processing module within Oracle E-Business Suite (EBS), a widely-deployed enterprise resource planning platform used by large organizations globally. The affected version range spans EBS 12.2.3 through 12.2.15. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation occurs via HTTP with no special network positioning, low complexity, and only a baseline EBS user account. Intelligence tagging identifies this as an Authentication Bypass, implying that the Payroll module fails to properly enforce authorization controls - a low-privileged user can likely access Payroll HTTP endpoints or API calls that should be restricted to payroll administrators. No CWE has been officially assigned, but the described behavior is consistent with CWE-285 (Improper Authorization) or CWE-862 (Missing Authorization). The unchanged scope (S:U) confirms the impact is contained within the Oracle Payroll component itself.

RemediationAI

Apply the relevant patches from the Oracle Critical Patch Update for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU is the authoritative source for patch availability; an exact patched version number is not independently confirmed beyond the CPU designation, so consult the Oracle advisory directly for the applicable patch ID for your EBS release. As a compensating control prior to patching, restrict network access to Oracle EBS Payroll HTTP endpoints to only authorized payroll department IP ranges using firewall or VPN controls - note this may impact legitimate remote payroll staff. Additionally, audit EBS responsibility and role assignments to enforce least-privilege: ensure that users without payroll administrative duties do not hold responsibilities that grant access to Payroll module functions. These controls reduce the exposed attack surface but do not eliminate the underlying authorization flaw.