EUVD-2026-106283
GHSA-f9w7-22wc-pgxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitSend crafted HTTP request to Korean Payroll component
-
ExecutionBypass access controls on HRMS data
-
ImpactExfiltrate confidential payroll/HR records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to an instance running the Oracle HRMS (Republic of Korea) product, specifically the Korean Payroll component, on versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and complexity is low (AC:L). Exploitation is LIMITED by: (1) the need for pre-existing authenticated access rather than fully anonymous access; (2) the requirement that the Korea-specific payroll localization module actually be deployed and in use, which is uncommon outside organizations running South Korean payroll; and (3) impact confined to data confidentiality, with no write or availability consequences. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor CVSS 3.1 score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L), meaning an authenticated foothold is needed. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read critical or all HRMS data but cannot modify it or affect availability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, and Oracle (the sole source) does not publish exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' A notable conflict: the input Tags include 'Authentication Bypass,' but the description explicitly describes a 'low privileged attacker' and the CVSS carries PR:L - an authentication bypass would imply PR:N, so this tag appears inconsistent with the authoritative metrics and should not be treated as confirmed. No SSVC decision data was supplied. Net: a real data-exposure flaw worth patching in the Oct 2026 Oracle CPU cycle, but mitigated by the authentication requirement and the narrow, region-specific component. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the Oracle HRMS (Republic of Korea) Korean Payroll component and leverages an access-control weakness to read sensitive payroll and HR records they are not authorized to view. No public proof-of-concept is available, and the attack yields data disclosure only - no data tampering or service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle HRMS (Republic of Korea) payroll localization for E-Business Suite 12.2.3 through 12.2.15 permits a low-privileged, network-positioned attacker with a valid EBS account to read sensitive data beyond their intended authorization scope through the Korean Payroll component, yielding a high confidentiality impact with no integrity or availability effect (CVSS 6.5). Exploitation requires only low-privileged authenticated HTTP access, no user interaction, and low attack complexity, but is practically gated by whether an organization actually deploys the Korea-specific payroll localization outside South Korean deployments. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style risk is tempered by the module's narrow deployment footprint.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update to Oracle E-Business Suite 12.2.x - the CPU referenced at https://www.oracle.com/security-alerts/cpuoct2026.html contains the fix for the Korean Payroll component for all affected releases 12.2.3 through 12.2.15; Oracle CPU patches are cumulative, so applying the latest CPU covers this and prior fixes, but note the downtime window required for EBS patching and the need to run the associated AD utilities and validate Korean payroll localization objects post-patch. Where patching must be deferred, compensating controls should focus on the authenticated access precondition: audit and reduce the population of low-privileged EBS users who hold any HRMS or payroll-related responsibilities, and remove the Korean Payroll responsibility/menu from users who do not require it, accepting that this does not remediate the underlying authorization flaw and may disrupt legitimate payroll operations. Additionally, restrict network access to the EBS HTTP tier to trusted corporate ranges or VPN via reverse-proxy ACLs, acknowledging this adds friction for legitimate remote payroll users and is bypassed by any internal foothold. Monitor HTTP access logs and database audit trails for anomalous payroll data retrieval by low-privileged accounts, and prioritize remediation only where the Republic of Korea localization is genuinely deployed, since instances without the Korean Payroll module are not exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Korean Payroll module of Oracle HRMS (Republic of Korea), a country-specific localization layer built on top of Oracle E-Business Suite's HRMS schema and delivered as part of the 12.2.x application stack. Oracle's CPU labels this an easily exploitable, low-privileged information disclosure - the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates an HTTP-reachable endpoint that validates a session but does not adequately enforce authorization on the data it returns, so an authenticated user can retrieve payroll data they should not see. Because Korean payroll localizations embed statutory and tax-related employee data, successful exploitation exposes highly sensitive personal and compensation records. No CWE was supplied in the source data, but the access-control failure pattern aligns with improper authorization / missing function-level access control rather than memory-safety issues, and there is no code-execution dimension. The confidentiality-only impact and the requirement for a pre-existing session are what keep the score at 6.5 rather than critical.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity, but a low-privileged authenticated account is required (PR:L); impact is confidentiality-only, so I:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Republic of Korea). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Republic of Korea) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB