Oracle Payroll EUVD-2026-47439

Exploitation requires a valid, low-privileged Oracle E-Business Suite user account with HTTP network access to the EBS application server - any basic EBS login suffices, with no elevated roles or payroll-specific responsibilities needed (PR:L per CVSS). The Payroll component must be deployed and accessible within the target EBS instance (versions 12.2.3-12.2.15). No special non-default configuration, specific platform variant, or additional feature enablement is documented as required beyond having Oracle Payroll installed as part of EBS. Exploitation is limited by the mandatory authentication prerequisite - fully unauthenticated external attackers cannot exploit this without first obtaining at least one valid EBS credential. Network access to the EBS HTTP interface is required; deployments where EBS is fully isolated to an internal network without external exposure reduce the external threat surface but remain vulnerable to insider or compromised-credential attacks.

The vendor-assigned CVSS 3.1 score of 6.5 (Medium) reflects the impact accurately: network-reachable, low complexity, confidentiality-only breach. However, the business impact of a confidentiality breach in a payroll system significantly exceeds what the numeric score conveys - exposure of salaries, tax filings, and bank account details for an entire organization is a material data breach event with regulatory consequences (GDPR, CCPA, SOX). The Authentication Bypass tag elevates concern beyond a simple information disclosure: it implies the access control failure is categorical rather than incidental. No EPSS data was provided in the input, so exploitation probability cannot be quantified. No KEV listing exists and no POC has been identified, meaning exploitation urgency is not externally confirmed. The low attack complexity (AC:L) and absence of required user interaction (UI:N) mean that any EBS user who attempts exploitation faces minimal technical barriers. Priority should be treated as higher than the raw CVSS score suggests for organizations where untrusted or broadly-credentialed users have EBS HTTP access.

An attacker holding any valid Oracle E-Business Suite account - such as a regular employee, contractor, or a credential obtained via phishing - sends crafted HTTP requests directly to the Oracle Payroll component endpoints, exploiting the authorization bypass to retrieve payroll records beyond their assigned access level. No public exploit code has been identified, but the low attack complexity (AC:L) means no specialized tooling or vulnerability expertise is required. A successful attacker could silently exfiltrate the complete payroll dataset - salaries, banking details, and tax information for all employees - without triggering privilege escalation alerts, since they remain operating under their legitimate session.