Oracle Payroll EUVD-2026-106404

Exploitation targets the Internal Operations component of Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reached remotely over HTTP. It requires a valid low-privileged account (PR:L) - this is NOT unauthenticated - and the high attack complexity (AC:H) means the attacker must satisfy additional conditions beyond their control (such as specific application state, timing, or configuration) that make reliable exploitation difficult. Limiting factors: authentication is mandatory, no exploit is public, exploitation is complex, and only the EBS 12.2.x release line is affected; no victim user interaction is required (UI:N).

CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable flaw over HTTP that nonetheless requires a valid low-privileged account (PR:L) and has high attack complexity (AC:H) - meaning successful exploitation depends on conditions outside the attacker's direct control, not a trivial one-shot. The full C:H/I:H/A:H impact (Oracle explicitly states 'takeover of Oracle Payroll') makes the technical impact total, so the severity is driven by impact rather than ease of exploitation. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' and real-world exploitation likelihood cannot be quantified from the data provided. The combination of AC:H plus required authentication substantially tempers the 7.5 score: this is a serious patch-priority item for organizations running affected Oracle E-Business Suite Payroll, but absent EPSS/KEV/POC signals it reads as a high-impact-but-non-trivial issue rather than a confirmed mass-exploited emergency. Note a metadata conflict: the input Tags label this 'Information Disclosure,' yet the description and CVSS (C:H/I:H/A:H, 'takeover') describe full compromise, not mere disclosure - treat that tag as inaccurate.

A low-privileged but authenticated user (for example, an employee with limited self-service Payroll access) sends crafted HTTP requests to the Internal Operations component of Oracle Payroll and, by satisfying specific non-default or state/timing conditions (reflected in AC:H), escalates to full control of the Payroll module. No public exploit code is identified at time of analysis, and the high attack complexity means a working exploit would require effort and favorable conditions. A successful attack yields complete compromise of payroll confidentiality, integrity, and availability.