EUVD-2026-105950
GHSA-97w2-v79w-52gh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Payroll component
-
ExecutionTrigger unauthorized data access in Internal Operations
-
ImpactExfiltrate sensitive payroll data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on Oracle E-Business Suite with network HTTP access to the Oracle Payroll Internal Operations component on affected versions 12.2.3 through 12.2.15; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the authentication prerequisite (PR:L) - an attacker must already hold valid EBS credentials, so this is not remotely exploitable by fully unauthenticated attackers. Impact is confined to confidentiality (unauthorized read of Payroll data); integrity and availability are unaffected. |
| Impact | This is a moderate, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L) and yields only confidentiality impact (C:H, I:N, A:N) - no data tampering or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no signal of active or probable near-term exploitation. The signals are internally consistent except for the 'Authentication Bypass' tag, which conflicts with PR:L: a genuine auth bypass would normally imply PR:N, so this tag appears mislabeled - Oracle's own text describes 'low privileged attacker' access, not a bypass. Net: a real patch-cycle priority for organizations running affected Oracle Payroll, but not an exploit-now crisis given the authentication prerequisite and confidentiality-only impact. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle E-Business Suite account (for example a routine self-service or internal portal user) sends crafted HTTP requests to the Oracle Payroll Internal Operations component. Exploiting the flaw, they read payroll data they are not authorized to see - potentially all Oracle Payroll accessible data including sensitive compensation and personal information. No public exploit code is identified at time of analysis, and attack complexity is low once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Payroll 12.2.3 through 12.2.15 can disclose sensitive payroll records to an authenticated low-privileged E-Business Suite user who can reach the Internal Operations component over HTTP. The flaw is rated CVSS 6.5 with high confidentiality impact and no integrity or availability impact; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
RemediationAI
Patch availability is documented through the Oracle Critical Patch Update for October 2026 at https://www.oracle.com/security-alerts/cpuoct2026.html; apply the applicable Oracle E-Business Suite 12.2.x patch level for Oracle Payroll, because no separate exact fix version was provided in the supplied data. Until the patch is applied, restrict network access to the Payroll Internal Operations HTTP endpoints to trusted users and network segments, remove or disable unnecessary low-privileged EBS accounts, and audit payroll-data access for anomalous reads by low-privileged users; these controls reduce exposure but do not eliminate the underlying flaw, and network restrictions may disrupt legitimate payroll integrations. Because exploitation requires only low privileges, enforce least privilege and review accounts that can reach the affected component.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle E-Business Suite, with the issue located in the Internal Operations component of the Oracle Payroll product. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N describes a network-reachable, low-complexity information-disclosure flaw that requires a low-privileged authenticated account and no user interaction, with scope unchanged and impact limited to confidentiality. No CWE mapping was supplied, so the precise coding or design defect cannot be confirmed from the available data; operationally, the issue allows an authenticated user to read payroll data beyond their intended authorization. The supplied tags include 'Authentication Bypass' and 'Oracle', but the authoritative assessment and CVSS vector specify PR:L, so this should not be treated as an unauthenticated bypass. No CPE identifiers were included in the supplied data; the affected version range is corroborated by EUVD as Oracle Payroll 12.2.3 through 12.2.15.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity; PR:L because a valid low-privilege EBS account is required; confidentiality-only impact per Oracle, so I:N and A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB