EUVD-2026-47511
GHSA-fwg8-244h-fhxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliveryReach Public Sector Payroll HTTP endpoint
-
ExploitSend crafted request to Internal Operations
-
ExecutionExploit flaw to escalate
-
ImpactTake over payroll module and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) and network HTTP reachability to the Public Sector Payroll Internal Operations component; it does not require user interaction or high privileges. Limiting factors: only EBS versions 12.2.3 through 12.2.15 running the Public Sector Payroll module are affected, the module is chiefly deployed by government and public-sector organizations rather than universally, and the web tier must be network-reachable to the attacker. The exact feature or request that triggers takeover is not disclosed by Oracle, so the precise triggering configuration cannot be confirmed from available data. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a genuinely serious, easily exploitable issue: remotely reachable over HTTP, low attack complexity, no user interaction, and full CIA impact - but it requires an existing low-privilege account (PR:L), which meaningfully narrows the attacker population to those who can already authenticate to the EBS instance. No EPSS score, SSVC decision, or KEV entry was provided, so exploitation probability and automatability cannot be quantified from this data set; the absence of a POC lowers immediate mass-exploitation risk. Note a signal conflict: the intelligence tag labels this 'Information Disclosure,' yet the CVSS vector and description assert full integrity and availability compromise (takeover) - the CVSS/description should be treated as authoritative and the tag as under-scoped. Because Oracle EBS is a high-value target and PR:L is easily satisfied on multi-user public-sector deployments, this warrants prompt patching despite the missing EPSS/KEV signals. |
| Exploit ScenarioDerived | An attacker holding any low-privilege EBS account (for example a self-service employee or a compromised low-tier credential) sends crafted HTTP requests to the Public Sector Payroll Internal Operations endpoints and, exploiting the flaw, escalates to full control of the payroll module - reading and altering payroll data or disrupting the service. No user interaction is required, though the attacker must first authenticate; no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though Oracle does not publish a discrete fixed build number, so track the CPU patch for your EBS 12.2.x release train and apply it to all instances running 12.2.3 through 12.2.15. Because exploitation needs a low-privileged authenticated account, effective compensating controls until patching completes include restricting network reachability of the EBS web tier to trusted VPN/segmented networks, tightening and auditing accounts that can reach Public Sector Payroll / Internal Operations self-service pages, and enabling web-tier logging plus WAF rules in front of the EBS HTTP endpoints; the trade-off is that access restrictions may disrupt legitimate remote payroll users and a WAF cannot reliably block an authenticated abuse path. Do not rely on network controls as a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is Oracle Public Sector Payroll, a payroll module within the Oracle E-Business Suite (EBS) applications stack, specifically the Internal Operations component. EBS is a large Java/PL-SQL enterprise resource planning platform typically fronted by an Oracle Application Server / WebLogic web tier and backed by an Oracle Database, exposing servlets and self-service HTTP endpoints. Oracle assigned no CWE (N/A) and, per its standard Critical Patch Update disclosure practice, withholds root-cause detail; the 'takeover' language combined with a low-privilege network vector is characteristic of authenticated web-tier flaws in EBS such as injection, insecure deserialization, or broken access control, but the exact weakness class is unconfirmed from the available data.
Know when Public Sector Payroll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable with low complexity and no interaction, but requires an existing low-privilege EBS account (PR:L); takeover yields full C/I/A impact within an unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Public Sector Payroll (E-Business Suite 12.2.3-12.2.15) contains a critical account takeover vulnerability (CVSS 8.8) allowing attackers with low-privilege access and network adjacency to fully compromise the payroll module and exfiltrate sensitive employee and financial data. Affected public sector organizations currently lack patches and must immediately restrict network access to the payroll system and implement access controls to prevent unauthorized compromise. While no public exploit has been identified to date, the high-severity nature and lack of available patches create significant risk for vulnerable deployments.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforce network segmentation to restrict access to the Public Sector Payroll module from non-administrative systems, require multi-factor authentication for all payroll module access, implement real-time monitoring and alerting for suspicious payroll module access patterns, disable or restrict low-privilege user access to the module where operationally feasible, and maintain detailed audit logs of all payroll module interactions. Apply Oracle Critical Patch Update for July 2026 as the primary remediation when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB