What is the CVSS score of EUVD-2026-47190?

EUVD-2026-47190 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-47190?

Within 24 hours: audit all Oracle E-Business Suite instances to identify those running versions 12.2.3 through 12.2.15 and notify payroll operations and compliance teams of exposure. Within 7 days: restrict network access to the Public Sector Payroll module to essential personnel and systems only, enforce multi-factor authentication for all accounts with payroll module access, and enable detailed audit logging on payroll transactions. Within 30 days: contact Oracle support to track patch availability for CVE-2026-60924, develop and lab-test an upgrade path to a patched version once released, and document all access restrictions as interim compensating controls.

Oracle E-Business Suite EUVD-2026-47190

| CVE-2026-60924 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-75jr-v622-w743

Privilege Escalation Oracle E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged EBS account
Delivery

Reach Payroll web tier over HTTP
Exploit

Send crafted request to Internal Operations
Execution

Escalate within Public Sector Payroll
Impact

Take over payroll module and data

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the attacker to already hold a low-privileged, authenticated Oracle E-Business Suite account (CVSS PR:L) and network HTTP reachability to the EBS web tier hosting the Public Sector Payroll Internal Operations component on an affected 12.2.3-12.2.15 install. What limits exploitation: valid credentials are mandatory (not exploitable pre-authentication), and the target must be running the Public Sector Payroll product specifically - an EBS deployment without that module licensed/enabled is not affected. No user interaction, no elevated privileges, and no special non-default configuration are cited beyond having the module deployed, and Oracle labels it 'easily exploitable.'
Impact	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) signals genuine exploitability: remote over HTTP, low complexity, no user interaction, and only low privileges required, with full CIA impact. The mitigating factor is PR:L - the attacker must already hold a valid low-privileged EBS account, so this is not unauthenticated internet-wide exploitation; realistic risk is highest where many employees, contractors, or partners hold EBS logins. No EPSS score, KEV entry, POC, or SSVC decision was supplied, so exploitation probability cannot be quantified from the input and there is no evidence of active exploitation. Note a signal conflict: the tag says 'Information Disclosure,' yet the description and I:H/A:H metrics indicate full compromise/takeover - treat this as a takeover-class issue and verify scope with Oracle. Overall this is a real priority for EBS operators, tempered by the authentication requirement.
Exploit ScenarioDerived	A contractor, employee, or partner holding a low-privileged Oracle E-Business Suite account authenticates to the web tier and sends crafted HTTP requests to the Public Sector Payroll Internal Operations functions. Because attack complexity is low and no user interaction is needed, the request escalates their access and yields full control of the payroll module, exposing and altering employee pay and PII. No public exploit is identified at time of analysis, so an attacker would need to develop their own request.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle does not publish a standalone fixed build number and the fix ships as the quarterly CPU bundle for EBS 12.2.x, so identify and apply the specific patch listed in that CPU for your 12.2.3-12.2.15 release. Because exploitation requires a low-privileged account, compensating controls until patching completes include restricting network access to the EBS web tier to trusted internal segments and VPN users only, tightening and auditing EBS user provisioning to remove unnecessary low-tier accounts, and placing a WAF or reverse proxy in front of the Payroll/Internal Operations endpoints to log and rate-limit access - with the trade-off that these reduce but do not eliminate risk for legitimate authenticated users and may disrupt integrations relying on those endpoints. Do not deploy invented version numbers; rely on the CPU patch mapping for your exact release.

Affected VersionsENISA

Oracle Public Sector Payroll 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_public_sector_payroll no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is a large web-based ERP platform; the affected piece is the Public Sector Payroll product, specifically its Internal Operations component, which handles government and public-sector payroll processing. The vulnerability is reached over HTTP through the EBS web tier, consistent with the servlet/mod_plsql front-end that exposes application functions to authenticated users. Oracle assigned no CWE (CWE: N/A) and withholds root-cause detail per its Critical Patch Update disclosure policy, but the C:H/I:H/A:H 'takeover' outcome from a low-privileged position is characteristic of a broken access control or injection flaw enabling privilege escalation within the module, rather than a pure information-disclosure bug despite the 'Information Disclosure' tag.

Know when E Business Suite gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Remote HTTP, low complexity, no interaction, but a valid low-privileged EBS account is required (PR:L); full module takeover gives C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Compromised payroll operations pose critical risk to wage processing and employee data. CVE-2026-60924 affecting Oracle E-Business Suite versions 12.2.3-12.2.15 Public Sector Payroll module enables account takeover via low-privileged network access, potentially disrupting wage processing, compromising employee personal data, and creating compliance and operational risk for public sector organizations.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Public Sector Payroll module through network segmentation or application-level controls, enforce multi-factor authentication for all payroll-related accounts, implement role-based access control to limit low-privileged account permissions, and establish real-time monitoring and alerting on payroll module access patterns and transactions.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Medium

widely-used ERP suite, but public-sector payroll module is specialized

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.