What is the CVSS score of CVE-2026-62464?

CVE-2026-62464 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Payroll are affected by CVE-2026-62464?

Oracle Payroll (Internal Operations) in E-Business Suite versions 12.2.3-12.2.15 can be completely compromised by any low-privileged user over HTTP, exposing payroll and employee financial data.

How to fix or mitigate CVE-2026-62464?

Within 24 hours, identify and isolate all Oracle E-Business Suite instances running Payroll (Internal Operations) component in versions 12.2.3 through 12.2.15 from untrusted network access by implementing firewall restrictions on HTTP connections to the Payroll module. Within 7 days, enforce role-based access controls to restrict low-privileged user access to critical Payroll functions and implement enhanced logging and monitoring of all Payroll module activities. Within 30 days, monitor Oracle's security advisories for patch availability, and if no patch is released, develop an upgrade timeline or establish permanent compensating controls including network segmentation and multi-factor authentication for Payroll administrative access.

Oracle Payroll CVE-2026-62464

EUVD-2026-47502 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-mqh9-r3m2-4222

Privilege Escalation Oracle Payroll

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and no interaction, but requires a low-privileged account (PR:L); full product takeover gives C/I/A high with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:47 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.

Technical ContextAI

Oracle Payroll is a module within Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise ERP platform typically fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component and 12.2.x codeline indicate this is the EBS 12.2 release family. No CWE was assigned in the source data, so the precise root-cause class (e.g., authorization bypass, injection, or deserialization) cannot be stated with certainty; Oracle CPU entries characteristically withhold technical internals. The vendor-supplied tag 'Information Disclosure' partially conflicts with the CVSS profile, which shows high impact to all three of confidentiality, integrity, and availability (full 'takeover'), suggesting the impact is broader than disclosure alone.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle distributes EBS 12.2 remediation as CPU patch bundles rather than a single tagged version, so identify and apply the specific 12.2.x CPU patch for your installed release. As compensating controls until patching completes: restrict network reachability of the Oracle Payroll/EBS HTTP endpoints to trusted internal networks or VPN only (reduces the AV:N exposure, at the cost of blocking any legitimate external self-service access); tighten and audit low-privilege application accounts since PR:L means any low-tier authenticated user is a viable attacker (may disrupt users if over-restricted); and enable enhanced logging/WAF inspection on EBS URLs to detect anomalous requests. These controls reduce reachable attack surface but do not remove the underlying flaw - the CPU patch is the only true fix.