EUVD-2026-61888
GHSA-gff5-p786-6c86
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vector confirmed by description requiring infrastructure logon; PR:L reflects low-privileged attacker; S:C confirmed as attacks may impact additional co-hosted EBS products.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an authenticated, low-privileged logon to the operating system or application infrastructure where Oracle Payroll executes, as confirmed by AV:L and PR:L in the CVSS vector - remote unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 reflects genuine severity driven by full CIA impact and scope change, but the local attack vector (AV:L) is the critical risk-limiting factor: a threat actor cannot exploit this remotely from the internet without first obtaining a foothold on the infrastructure hosting Oracle Payroll. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the relevant patch set from the Oracle Critical Patch Update for August 2026, available via the Oracle security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; the exact patched build number within the EBS 12.2 release train must be confirmed against the CPU documentation, as Oracle does not publish a single replacement version number separately from the patch set. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict administrative and developer logon access to hosting infrastructure accounts for affected Oracle EBS systems and review infrastructure authentication logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged,
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), ver
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in su
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged aut
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today