EUVD-2026-61892
GHSA-7jcm-pjr8-574r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-accessible HTTP vector with low-privilege credential sufficient; scope change and high confidentiality align with described data exposure across EBS modules; no integrity or availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Oracle E-Business Suite account with low-level privileges - any authenticated EBS user, including self-service HR, payroll clerk, or contractor roles, is a viable attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), requiring only low privileges (PR:L), no user interaction (UI:N), with high confidentiality impact across a scope change (S:C/C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update for August 2026, available via Oracle Support (My Oracle Support patch delivery). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, implement network-level restrictions limiting EBS Payroll access to authenticated, trusted personnel only and enable comprehensive database logging for all payroll-related queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), ver
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in su
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged aut
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today