Oracle Payroll EUVD-2026-105963

Exploitation requires an authenticated session with at least low-privilege access to Oracle E-Business Suite (PR:L) and network reachability of the Oracle Payroll module's HTTP interface. The specific attack surface is the Payroll 'Element Types, Links, Entries' component on supported versions 12.2.3 through 12.2.15. Limiting factors: the attacker must already possess valid EBS credentials (no anonymous access), impact is restricted to data integrity with no read/confidentiality or availability effect, and the flaw is confined to the Payroll product rather than the whole EBS stack - so exposure is bounded by how broadly low-privilege payroll/self-service accounts are provisioned and whether the EBS instance is internet-facing versus internal-only.

This is a moderate-priority issue best characterized as a meaningful-but-not-emergency integrity flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) is internally consistent: network-reachable over HTTP, low attack complexity, no user interaction, but requiring low-level privileges (PR:L) - i.e. an authenticated EBS user account. Impact is confined to integrity (I:H) with no confidentiality or availability loss, meaning an attacker can create, delete or modify critical Oracle Payroll data but cannot read it out or crash the service through this flaw alone. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which specifies PR:L (authentication required) and describes a 'low privileged attacker' - this is not an unauthenticated bypass, and the tag appears mislabeled; verify with Oracle CPU Oct 2026 before treating it as auth-bypass. Net: real priority for Oracle Payroll operators because any authenticated user could tamper with payroll data, but the mandatory authentication and integrity-only scope keep it below critical urgency.

A low-privileged but authenticated Oracle E-Business Suite user (for example, a legitimate HR or employee self-service account) sends crafted HTTP requests to the Oracle Payroll Element Types/Links/Entries component to create, alter or delete payroll data they should not control - e.g. injecting fraudulent pay elements or deleting entries. Because AC:L and UI:N, the action is reliable and needs no victim interaction. No public exploit code was identified at time of analysis, so this would require an attacker to develop the request themselves.