Oracle Payroll EUVD-2026-105964

Exploitation requires network access to the Oracle Payroll component's Internal Operations interface over HTTP AND a valid low-privileged Oracle E-Business Suite account (PR:L) - it is not reachable by a fully unauthenticated attacker. The affected deployments are Oracle Payroll within EBS versions 12.2.3 through 12.2.15. The primary limiting factor is the high attack complexity (AC:H): Oracle explicitly describes it as 'difficult to exploit,' implying the attacker must satisfy conditions outside their direct control (e.g., specific timing, state, or configuration) beyond simply holding credentials. No user interaction is required (UI:N), so a motivated authenticated insider or a credential-compromise foothold is the realistic threat profile rather than untargeted internet-wide scanning.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.5 (HIGH) reflects full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) resulting in complete takeover of Oracle Payroll, but the vector is materially constrained: while network-reachable over HTTP (AV:N), it carries high attack complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L). Oracle itself labels it 'difficult to exploit.' No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was referenced, so all three real-world exploitation signals are either absent or negative - there is no public exploit identified at time of analysis. The combination of AC:H plus a required valid credential meaningfully lowers the practical likelihood of opportunistic mass exploitation relative to the raw 7.5 score. No SSVC decision data, EPSS probability, or automatability signal was supplied, so the real-world-exploitation dimension cannot be independently corroborated beyond the absence of KEV/POC. Net: patch on a normal prioritized cycle for an authenticated-access enterprise ERP flaw, but this is not a drop-everything emergency on the evidence provided.

A low-privileged user with an existing Oracle E-Business Suite Payroll account (or an attacker who has phished/obtained such credentials) sends specially crafted HTTP requests against the Internal Operations component. By satisfying the difficult-to-meet preconditions implied by AC:H, they chain the flaw to gain full control of the Payroll module, exposing and altering sensitive salary/PII data. No public exploit code is known, so exploitation currently requires original development effort.