What is the CVSS score of EUVD-2026-47511?

EUVD-2026-47511 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Public Sector Payroll are affected by EUVD-2026-47511?

Oracle Public Sector Payroll (E-Business Suite 12.2.3-12.2.15) contains a critical account takeover vulnerability (CVSS 8.8) allowing attackers with low-privilege access and network adjacency to…

How to fix or mitigate EUVD-2026-47511?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with the Public Sector Payroll module enabled and restrict network access to the payroll component to authorized users and systems only, preferably through a VPN or bastion host with multi-factor authentication. Within 7 days, implement enhanced monitoring and logging for all access to the payroll module and Internal Operations component, conduct a forensic review of access logs from the past 60 days for indicators of compromise, and establish a pre-staging environment to test the Oracle Critical Patch Update for July 2026. Within 30 days, apply the Oracle Critical Patch Update for July 2026 to all affected production systems following successful pre-production validation, perform comprehensive security testing of the payroll module post-patch, and conduct a forensic review of payroll system logs to confirm no unauthorized access occurred during the interim period.

Oracle Public Sector Payroll EUVD-2026-47511

| CVE-2026-62476 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-fwg8-244h-fhxf

Privilege Escalation Oracle Public Sector Payroll

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and no interaction, but requires an existing low-privilege EBS account (PR:L); takeover yields full C/I/A impact within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:44 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.

Technical ContextAI

The affected software is Oracle Public Sector Payroll, a payroll module within the Oracle E-Business Suite (EBS) applications stack, specifically the Internal Operations component. EBS is a large Java/PL-SQL enterprise resource planning platform typically fronted by an Oracle Application Server / WebLogic web tier and backed by an Oracle Database, exposing servlets and self-service HTTP endpoints. Oracle assigned no CWE (N/A) and, per its standard Critical Patch Update disclosure practice, withholds root-cause detail; the 'takeover' language combined with a low-privilege network vector is characteristic of authenticated web-tier flaws in EBS such as injection, insecure deserialization, or broken access control, but the exact weakness class is unconfirmed from the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though Oracle does not publish a discrete fixed build number, so track the CPU patch for your EBS 12.2.x release train and apply it to all instances running 12.2.3 through 12.2.15. Because exploitation needs a low-privileged authenticated account, effective compensating controls until patching completes include restricting network reachability of the EBS web tier to trusted VPN/segmented networks, tightening and auditing accounts that can reach Public Sector Payroll / Internal Operations self-service pages, and enabling web-tier logging plus WAF rules in front of the EBS HTTP endpoints; the trade-off is that access restrictions may disrupt legitimate remote payroll users and a WAF cannot reliably block an authenticated abuse path. Do not rely on network controls as a substitute for the CPU patch.