Description

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:17:52.697Z",
  "pubdate": "2026-08-18T21:17:52.697Z",
  "executiveSummary": "A security vulnerability has been identified within the Internal Operations component of the Oracle Payroll product, part of the Oracle E-Business Suite. This vulnerability allows a low-privileged attacker with network access via the HTTP protocol to compromise the system and achieve unauthorized access to sensitive information. Affected supported versions span from 12.2.3 to 12.2.15.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.7, with a vector indicating a network attack vector, low attack complexity, low privilege requirements, and no user interaction required. A critical characteristic of this flaw is a scope change, meaning that successful exploitation within Oracle Payroll can significantly impact additional products integrated within the environment.\nThe primary impact of successful exploitation is severe confidentiality degradation, resulting in unauthorized access to critical data or complete access to all data accessible by Oracle Payroll. Due to the remote network exploitability and low privilege threshold, organizations utilizing the vulnerable versions face substantial risk regarding data exposure and potential secondary impacts across dependent systems.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It exposes an attack surface accessible remotely via the HTTP protocol, allowing threat actors with low-level credentials to interact directly with vulnerable internal logic handling payroll data and operations.\nExploitation requires network connectivity to the targeted Oracle E-Business Suite instance and valid low-privileged user credentials. Because the attack vector is network-based (AV:N), adversaries do not require physical access or local shell execution on the host machine. The low attack complexity (AC:L) indicates that the conditions for successful exploitation are reliably reproducible without complex race conditions or specialized environmental setups, and no user interaction (UI:N) is mandated.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP-based network connection to the exposed Oracle Payroll interface. Second, the attacker issues crafted requests targeted at the Internal Operations component, bypassing intended authorization checks or logic constraints governing data retrieval. Third, the backend application processes the request, failing to properly restrict data access based on the caller's low privilege level. Finally, the system returns unauthorized sensitive data to the attacker.\nDue to the scope change (S:C) metric defined in the CVSS vector, the vulnerability is not strictly confined to the immediate boundaries of Oracle Payroll. Successful exploitation permits the attacker to leverage the compromised component to impact additional connected products within the enterprise architecture. The resulting post-exploitation impact is focused strictly on confidentiality (C:H), yielding unauthorized read access to critical data or complete data sets accessible to the Oracle Payroll application context, while integrity and availability remain unaffected."
}