Oracle Payroll EUVD-2026-105966

Exploitation targets the Internal Operations component of Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reached over HTTP. Two concrete limiting factors apply: (1) the attacker must hold a low-privileged authenticated EBS account (PR:L) - this is not anonymous/unauthenticated; and (2) Oracle classifies it as 'difficult to exploit' (AC:H), indicating success depends on conditions the attacker cannot fully control, such as specific server state or timing, reducing reliability. No user interaction is required (UI:N). Organizations not running EBS 12.2.x or without the Payroll module deployed are not affected.

This is a genuine but second-tier priority. The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full triad impact - Oracle explicitly describes 'takeover of Oracle Payroll' - but two metrics meaningfully temper real-world risk: AC:H (Oracle states 'difficult to exploit,' implying the attacker must satisfy conditions outside their control such as race conditions or specific state) and PR:L (a valid low-privileged EBS account is required, so this is not an anonymous internet-facing drive-by). No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. One notable inconsistency: the input Tags label this 'Information Disclosure,' yet the description and the C:H/I:H/A:H vector describe complete product takeover, not mere disclosure - treat the tag as an under-classification rather than a limit on impact. Net: a credible insider/foothold-escalation risk for organizations running affected EBS Payroll, but the combination of high attack complexity, required authentication, and no evidence of active exploitation places it below internet-facing unauthenticated RCEs in patch urgency.

An attacker who already holds a low-privileged Oracle E-Business Suite account (or has phished/compromised one) reaches the Oracle Payroll Internal Operations component over HTTP and, by meeting the difficult-to-exploit preconditions, escalates to full control of the Payroll module - reading and altering payroll/PII data and disrupting its availability. No public exploit code is identified at time of analysis, and the high attack complexity means reliable exploitation likely requires specific timing or server state.