Payroll
Monthly
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download functionality with an absolute path or directory-traversal sequence in the file path parameter, with the server returning the file contents directly in the response. The issue is scored CVSS 4.0 9.2 (vendor/NVD) - network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact, and a scope change to subsequent systems - making payroll data, PII, credentials and configuration secrets the realistic target set. Because vendor contact attempts were unsuccessful, only version R2026.2.0 is confirmed affected and the full version range remains unknown; no public exploit code has been identified at time of analysis.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Reflected cross-site scripting in multiple Dayforce Payroll endpoints lets an unauthenticated attacker craft a URL that, once opened by a logged-in payroll user, runs arbitrary JavaScript in that user's browser session. Confirmed only in Dayforce Payroll R2026.2.0, with applicability to other versions unverified because repeated attempts to reach the vendor were unsuccessful, and with no public exploit identified at time of analysis. The real-world risk is genuine but modest: exploitation is gated by a mandatory victim click (UI:A/UI:R) and impact is confined to the victim's browser session, with no server-side compromise - no CISA KEV listing and no evidence of active exploitation in the available data.
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download functionality with an absolute path or directory-traversal sequence in the file path parameter, with the server returning the file contents directly in the response. The issue is scored CVSS 4.0 9.2 (vendor/NVD) - network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact, and a scope change to subsequent systems - making payroll data, PII, credentials and configuration secrets the realistic target set. Because vendor contact attempts were unsuccessful, only version R2026.2.0 is confirmed affected and the full version range remains unknown; no public exploit code has been identified at time of analysis.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Reflected cross-site scripting in multiple Dayforce Payroll endpoints lets an unauthenticated attacker craft a URL that, once opened by a logged-in payroll user, runs arbitrary JavaScript in that user's browser session. Confirmed only in Dayforce Payroll R2026.2.0, with applicability to other versions unverified because repeated attempts to reach the vendor were unsuccessful, and with no public exploit identified at time of analysis. The real-world risk is genuine but modest: exploitation is gated by a mandatory victim click (UI:A/UI:R) and impact is confined to the victim's browser session, with no server-side compromise - no CISA KEV listing and no evidence of active exploitation in the available data.
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.