EUVD-2026-47350
GHSA-7828-j9cq-4cvq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliveryReach Payroll Internal Operations over HTTP
-
ExploitSend crafted request bypassing authorization
-
ExecutionRead confidential payroll data across scope boundary
-
ImpactExfiltrate PII from Payroll and adjacent products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the Oracle EBS/Payroll HTTP interface and a valid low-privileged EBS user account (CVSS PR:L), with no user interaction and low attack complexity; the affected surface is the Oracle Payroll Internal Operations component on EBS 12.2.3-12.2.15. Limiting factors: the attacker must already authenticate with some low-privilege credential (this is not an anonymous, pre-auth attack per the CVSS vector), and only EBS installations that expose the payroll web tier are exploitable. Note the input's 'Authentication Bypass' tag conflicts with the authenticated PR:L vector - confirm with Oracle whether valid credentials are strictly required. |
| Impact | Signals are moderately concerning but not emergency-tier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) shows easy, network-reachable exploitation requiring only low privileges and no user interaction, with a scope change that amplifies impact to adjacent products - but impact is confidentiality-only, with no integrity or availability loss. There is no EPSS score, no SSVC decision data, no CWE, and no KEV listing in the provided input, and no public exploit identified at time of analysis, so exploitation is not confirmed in the wild. The PR:L requirement is the key mitigating factor: an attacker needs a valid low-privileged EBS account, which limits purely anonymous internet exploitation. This is a real priority for organizations running EBS (large, sensitive payroll/PII datasets), but the low-privilege prerequisite and confidentiality-only impact place it below a critical unauthenticated RCE. Note the tag 'Authentication Bypass' appears in tension with the PR:L (authenticated) vector - verify with Oracle whether a low-priv account is truly required or whether a genuine auth-bypass path exists. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privileged Oracle EBS account sends crafted HTTP requests to the Payroll/Internal Operations interface and, exploiting the authorization weakness, retrieves confidential payroll data (salaries, bank details, PII) they are not authorized to see. Because the vulnerability has a scope change, the same access may expose data in additional integrated Oracle products. No public proof-of-concept was identified at time of analysis, so exploitation would currently require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input does not state an exact fixed build number, so consult the CPU matrix for the precise patch for your EBS 12.2.x level and apply it across all instances in the 12.2.3-12.2.15 range. As Oracle CPUs are cumulative, install the latest available 12.2 CPU rather than a single one-off patch. Until patching, reduce exposure by restricting network reachability of the EBS/Payroll HTTP tier to trusted internal networks and VPN only, tightening least-privilege on EBS user accounts and payroll responsibilities to shrink the pool of low-privileged accounts that could trigger the flaw, and increasing auditing of payroll data access for anomalous reads. These controls reduce reachability and improve detection but do not remove the vulnerability, and over-restricting responsibilities may disrupt legitimate payroll operations, so validate changes before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Payroll is a module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP/HCM platform, exposed here through its web (HTTP) tier and the Internal Operations component. The vendor tag 'Authentication Bypass' combined with the CVSS metrics (PR:L, S:C, C:H) indicates an authenticated but low-privileged actor can cross a security boundary to read data they should not reach, extending into other EBS-integrated products. No CWE was assigned in the source data, but the pattern is consistent with a broken access-control / authorization-bypass class (e.g., CWE-284/CWE-639-style horizontal or vertical privilege issues) leading to sensitive information disclosure. The affected code path is reachable over the standard EBS HTTP interfaces used for payroll operations.
Know when Payroll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
HTTP-reachable and low-complexity but needs a valid low-privileged EBS account (PR:L); scope change (S:C) reflects impact to adjacent products; confidentiality-only, so I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle Payroll in E-Business Suite versions 12.2.3-12.2.15 contains an authorization flaw allowing any authenticated user with system access to read all payroll data, including employee compensation, tax records, and personal identifiers. The flaw affects scope boundaries and impacts other connected Oracle products, expanding organizational exposure. No vendor patch exists; immediate access controls are required to mitigate disclosure risk to employee and tax records.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce network-layer access restrictions using firewall segmentation to limit connections to Payroll functions; deploy WAF rules blocking unauthorized access patterns to Payroll data endpoints; reduce and audit low-privileged user role permissions with role-based access controls; enable detailed audit logging with alerting on all Payroll data access events; implement data masking or obfuscation of sensitive payroll fields where possible; consider temporary operational suspension of non-critical Payroll access until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged,
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in su
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Exploit-DB