Description

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:52.227Z",
  "pubdate": "2026-08-18T21:17:52.227Z",
  "executiveSummary": "A privilege escalation and infrastructure compromise vulnerability exists within the Internal Operations component of Oracle Payroll in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw is categorized as an easily exploitable vulnerability that enables a low-privileged authenticated attacker with local logon access to the target infrastructure to completely compromise the Oracle Payroll application.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.8 with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high impacts across confidentiality, integrity, and availability, alongside a significant scope change. Due to interconnected dependencies within the enterprise ecosystem, successful exploitation extends beyond Oracle Payroll, potentially impacting additional integrated products.\nAttacker capabilities require local access to the underlying infrastructure and low-level privileges to interact with internal operational components, eliminating the need for user interaction. Organizations utilizing the affected Oracle E-Business Suite versions face severe risk implications, including total loss of application control and potential cascading failures across the enterprise environment if remediation actions are not promptly implemented.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Payroll, part of the Oracle E-Business Suite product suite, specifically affecting versions 12.2.3 through 12.2.15. The root cause stems from insufficient security controls and improper privilege boundary enforcement within internal operational mechanisms executed on the host infrastructure.\nExploitation of this vulnerability requires the attacker to possess local access (AV:L) to the underlying infrastructure where Oracle Payroll executes, coupled with low privileges (PR:L) and no required user interaction (UI:N). The attack complexity is rated as low (AC:L), indicating that an authenticated local user can consistently and reliably trigger the flaw without encountering complex hurdles.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes a local session on the target infrastructure hosting the Oracle Payroll execution environment. Second, leveraging their existing low-level access, the attacker interacts with the vulnerable Internal Operations component of Oracle Payroll. Third, due to inadequate input validation, privilege separation, or authorization checks within the targeted component, the attacker executes arbitrary operations or manipulates internal execution states. Finally, the attacker successfully escalates privileges, leading to the complete takeover of the Oracle Payroll application.\nBecause the vulnerability exhibits a scope change (S:C), successful exploitation does not remain isolated to the Oracle Payroll component. The compromised execution context allows the attacker to leverage trust relationships and inter-process communications, resulting in high impacts (C:H, I:H, A:H) on confidentiality, integrity, and availability that significantly affect additional products and underlying systems within the broader architecture."
}