EUVD-2026-105955
GHSA-3jwj-pqwc-cwh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon to host
-
ExploitSatisfy difficult exploit preconditions
-
ExecutionAbuse Internal Operations component
-
ImpactAchieve full Oracle Payroll takeover
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local logon access to the infrastructure/host on which Oracle Payroll executes (CVSS AV:L - this is not remotely reachable over the network) plus a pre-existing low-privileged authenticated account (PR:L). The AC:H rating means a specialized, difficult-to-control precondition (such as timing, state, or environment-specific configuration) must be met, so exploitation is not reliably repeatable. Scope is unchanged (S:U), confining impact to the Oracle Payroll application itself. Limiting factors for defenders: only affects Oracle E-Business Suite Payroll versions 12.2.3 through 12.2.15, requires an attacker to already be authenticated and present on the application tier, and the high complexity reduces mass-exploitation potential. |
| Impact | The CVSS 3.1 base score of 7.0 (High) is driven entirely by the three H impacts (C:H/I:H/A:H = full product takeover), but the exploitability metrics substantially temper real-world risk: AV:L requires local logon to the infrastructure where Oracle Payroll executes (not network-reachable), AC:H indicates a difficult-to-exploit condition outside the attacker's control, and PR:L requires an existing authenticated low-privileged account. No EPSS score was provided in the input, so statistical exploitation probability cannot be quantified; the CVE is NOT in CISA KEV and no POC is referenced, so this is best treated as a patch-in-normal-cycle item rather than an emergency. The signals are internally consistent (no CVSS-vs-description conflict), and the combination of local vector, high complexity, and required authentication means this is a high-CVSS-but-moderate-real-risk issue - relevant mainly to multi-user Oracle EBS hosts where an attacker already holds a foothold, not to externally exposed attack surface. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account and local logon access to the host running Oracle Payroll (e.g., a malicious insider or an actor who has pivoted onto the application tier) satisfies a difficult, timing- or configuration-dependent precondition to abuse the Internal Operations component. Successful exploitation yields full takeover of Oracle Payroll, compromising confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and the AC:H rating indicates exploitation is non-trivial and not reliably repeatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Product takeover is possible in Oracle Payroll 12.2.3 through 12.2.15, where a low-privileged attacker who can log on locally to the infrastructure hosting the application can exploit a difficult-to-control condition to fully compromise Payroll confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming authentication with low privileges is required and that the attack is not network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: apply the Oracle Critical Patch Update (October 2026) that addresses CVE-2026-101544; the supplied data does not specify an exact one-off patch number, so use the CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html to identify and install the correct patch for the deployed E-Business Suite 12.2.x Payroll environment. Until patching is complete, reduce exposure by restricting OS and host logon to the Payroll application tier to a minimal set of trusted administrators, removing or disabling unnecessary low-privileged local accounts, and monitoring local logon and Payroll administrative activity; these controls trade off operational convenience and can complicate support access, so they should be balanced against business needs. No public exploit code or active exploitation was identified at time of analysis, but the high CIA impact warrants prompt patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Payroll is a module within Oracle E-Business Suite's HR and payroll stack, and this issue resides in its Internal Operations component. The supplied CVSS vector shows AV:L, meaning the attacker must first obtain logon access to the host or infrastructure where Oracle Payroll executes rather than reaching it over the network; PR:L indicates that a pre-existing low-privileged account is sufficient; AC:H indicates a specialized timing, state, or environment-specific configuration precondition that makes exploitation unreliable; S:U keeps impact scoped to the Payroll application; and C:H/I:H/A:H means successful exploitation can fully compromise Payroll confidentiality, integrity, and availability. No CWE was assigned in the supplied data, so the precise root-cause class is not confirmed, and the Oracle CPU advisory is the authoritative source for technical detail.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local logon to the Payroll host gives AV:L, the vendor's 'difficult to exploit' wording supports AC:H, a low-privileged account gives PR:L, and full takeover gives C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Payroll 12.2.3 through 12.2.15 carries a high-severity takeover risk that could let a locally authenticated low-privileged user fully compromise payroll confidentiality, integrity, and availability. Leadership should care because payroll is a sensitive, operationally critical system, and the issue is constrained to local infrastructure access but still requires controls and patching follow-up; no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict local logon to Oracle Payroll hosts to explicitly authorized accounts, enforce least privilege and separation of duties, monitor local authentication and payroll changes, isolate payroll infrastructure, and maintain tested backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB