Oracle Payroll CVE-2026-70945

Exploitation requires a valid Oracle E-Business Suite account with low-level privileges - any authenticated EBS user, including self-service HR, payroll clerk, or contractor roles, is a viable attacker. Network access via HTTP to the Oracle EBS application tier is necessary. The vulnerability resides in the Internal Operations component of Oracle Payroll, so the Payroll module must be deployed and accessible. No non-default configuration is described as required, and the CVSS vector (AC:L, PR:L) confirms low complexity and low privilege sufficiency. What limits exploitation: unauthenticated external attackers cannot exploit this directly - at minimum, a valid EBS credential is needed. Organizations that restrict EBS HTTP access to internal networks or VPN reduce external exposure. The scope change means impact extends beyond Payroll, but the extent of cross-module impact depends on the specific EBS configuration and inter-module data sharing in the target environment.

The CVSS 3.1 score of 7.7 is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), requiring only low privileges (PR:L), no user interaction (UI:N), with high confidentiality impact across a scope change (S:C/C:H). This is not a high-CVSS-but-low-real-risk case - the combination of low attack complexity, low privilege bar, and scope change makes this genuinely dangerous in enterprise environments where Oracle Payroll stores sensitive HR and compensation data. The 'Authentication Bypass' tag suggests the attacker's low-privilege credential is leveraged to circumvent authorization controls, not to bypass authentication entirely - a distinction that matters for triage but does not reduce risk meaningfully. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantitatively assessed. No KEV listing and no POC have been identified, consistent with a newly disclosed Oracle CPU advisory. The primary real-world risk is insider threat amplification and credential-based lateral data access; an attacker with any valid EBS account - including a payroll clerk, contractor, or compromised service account - can read all payroll data and potentially affect downstream EBS components. Oracle CPU August 2026 is the authoritative source; no independent third-party confirmation of exploitability is available at time of analysis.

An attacker holding any valid Oracle EBS account with low-privilege access - such as a self-service HR user, payroll clerk, or compromised service account - sends a crafted HTTP request to the Internal Operations component of Oracle Payroll over the network. Due to the authorization bypass flaw, the access control check is circumvented and the attacker retrieves complete payroll data - including salary, tax, and banking details - for all employees, and may access data within other EBS modules due to the scope change. No elevated privileges, special tooling, or user interaction are required beyond a valid low-privilege credential.