Oracle Payroll CVE-2026-70941

Exploitation requires the attacker to hold an authenticated, low-privileged logon to the operating system or application infrastructure where Oracle Payroll executes, as confirmed by AV:L and PR:L in the CVSS vector - remote unauthenticated exploitation is not possible. Oracle E-Business Suite 12.2.3 through 12.2.15 must be deployed in the target environment. No user interaction from a victim is required (UI:N), so the attack can proceed autonomously once the attacker has server access. Key limiting factors are: physical, SSH, RDP, or equivalent authenticated access to the EBS application node; possession of at least one low-privileged OS or EBS application account on that node; and deployment of an affected EBS 12.2.x release. The specific internal feature, API endpoint, or configuration state within Internal Operations that triggers the flaw is not disclosed in available data, so it is not possible to confirm whether non-default configuration is required. There is no indication from the description or CVSS that any special non-default setting must be enabled.

The CVSS 3.1 score of 8.8 reflects genuine severity driven by full CIA impact and scope change, but the local attack vector (AV:L) is the critical risk-limiting factor: a threat actor cannot exploit this remotely from the internet without first obtaining a foothold on the infrastructure hosting Oracle Payroll. This constrains the realistic threat model to insiders, compromised OS or service accounts, or attackers already present on the application server through a prior compromise. The scope change (S:C) is a meaningful risk amplifier - exploitation can pivot into adjacent EBS modules or shared infrastructure, which is a credible escalation path in typical large-enterprise EBS deployments. No EPSS score is available in the provided data, so exploitation probability cannot be quantified. No KEV listing and no public POC have been identified, suggesting exploitation has not been observed at scale. The ENISA tag of 'Information Disclosure' appears to materially understate the actual impact; the CVSS vector confirms full integrity and availability compromise - security teams should not rely on the ENISA tag alone for triage. Real-world priority is elevated specifically for organizations with shared application infrastructure, weak lateral separation between EBS components, or credible insider threat scenarios.

An attacker holding a low-privileged OS or application account on the server hosting Oracle Payroll - whether a disgruntled employee, a contractor with residual access, or a threat actor who phished or brute-forced service account credentials - interacts with the Internal Operations component to exploit the underlying flaw and escalate to full control of the Oracle Payroll application. With complete integrity and confidentiality access achieved, the attacker can exfiltrate sensitive employee compensation data or manipulate payroll records, and via the confirmed scope change, may further pivot laterally to compromise other Oracle EBS modules sharing the same application server or database infrastructure. No public proof-of-concept code has been identified, so the specific exploitation technique is not publicly known at time of analysis.