EUVD-2026-47502
GHSA-mqh9-r3m2-4222
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Payroll HTTP endpoint
-
ExploitSend crafted request to Internal Operations
-
ExecutionExploit flaw for takeover
-
ImpactExfiltrate/alter payroll data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Payroll HTTP interface plus a valid low-privileged account on the Oracle E-Business Suite instance (CVSS PR:L, so it is authenticated but not admin). No user interaction is required (UI:N) and attack complexity is low (AC:L). The affected deployment must be Oracle Payroll in the EBS 12.2 family, versions 12.2.3 through 12.2.15, via the Internal Operations component. Limiting factors that reduce real-world risk: the attacker must first obtain low-privilege credentials, and instances not exposing the Payroll HTTP endpoint beyond trusted networks materially shrink the attack surface. The exact triggering feature or configuration is not disclosed in the Oracle CPU advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) signals a genuinely serious, easily reachable issue: network-exploitable over HTTP, low attack complexity, no user interaction, and only low privileges required, with full high impact to C/I/A. Working against maximal urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC is referenced - so exploitation is currently theoretical rather than observed. The tension to flag: Oracle's tag says 'Information Disclosure' yet the vector and prose describe full 'takeover' with high integrity and availability impact - treat the CVSS/takeover framing as authoritative and the tag as an under-count. Net: this is a real priority for any exposed EBS 12.2 deployment because the barrier to exploit (one low-privileged account) is low, even though no in-the-wild activity is yet confirmed. |
| Exploit ScenarioDerived | An attacker who holds or phishes any low-privileged Oracle Payroll application account sends crafted HTTP requests to the Internal Operations component and, exploiting the flaw, escalates to full control of the Payroll module - reading sensitive payroll/PII data and altering or disrupting payroll operations. Because attack complexity is low and no user interaction is needed, this can be scripted once a foothold account exists. No public POC is currently referenced, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle distributes EBS 12.2 remediation as CPU patch bundles rather than a single tagged version, so identify and apply the specific 12.2.x CPU patch for your installed release. As compensating controls until patching completes: restrict network reachability of the Oracle Payroll/EBS HTTP endpoints to trusted internal networks or VPN only (reduces the AV:N exposure, at the cost of blocking any legitimate external self-service access); tighten and audit low-privilege application accounts since PR:L means any low-tier authenticated user is a viable attacker (may disrupt users if over-restricted); and enable enhanced logging/WAF inspection on EBS URLs to detect anomalous requests. These controls reduce reachable attack surface but do not remove the underlying flaw - the CPU patch is the only true fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Payroll is a module within Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise ERP platform typically fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component and 12.2.x codeline indicate this is the EBS 12.2 release family. No CWE was assigned in the source data, so the precise root-cause class (e.g., authorization bypass, injection, or deserialization) cannot be stated with certainty; Oracle CPU entries characteristically withhold technical internals. The vendor-supplied tag 'Information Disclosure' partially conflicts with the CVSS profile, which shows high impact to all three of confidentiality, integrity, and availability (full 'takeover'), suggesting the impact is broader than disclosure alone.
Know when Payroll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable with low complexity and no interaction, but requires a low-privileged account (PR:L); full product takeover gives C/I/A high with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Payroll (Internal Operations) in E-Business Suite versions 12.2.3-12.2.15 can be completely compromised by any low-privileged user over HTTP, exposing payroll and employee financial data. No patch is currently available from Oracle, requiring immediate mitigation. The ease of exploitation and broad user access risk make this a critical priority for any organization running affected versions.
Network segmentation isolating Payroll module HTTP access to administrative users only; restrict low-privileged user permissions to Payroll functions; implement detailed audit logging and alerting on all Payroll component access patterns; enforce multi-factor authentication for all Payroll administrative sessions; consider temporary limitation of Payroll module functionality for non-critical business operations pending patch release from Oracle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged,
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), ver
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in su
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Exploit-DB