Description

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T21:18:10.380Z",
  "pubdate": "2026-08-18T21:18:10.380Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle HRMS (US) product of Oracle E-Business Suite, specifically localized to the US Payroll Tax Issues component. This security flaw enables a low-privileged authenticated attacker with local logon access to the underlying infrastructure where Oracle HRMS (US) executes to achieve a complete system takeover of the targeted application. The vulnerability carries a CVSS 3.1 Base Score of 7.8, reflecting high severity impacts across Confidentiality, Integrity, and Availability. Successful exploitation requires local access vector, low privileges, and no user interaction, but grants the adversary total control over the affected application environment, presenting severe risk implications for enterprise payroll operations and sensitive employee data security.",
  "technicalDetails": "The vulnerability resides in the US Payroll Tax Issues component of Oracle HRMS (US) within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. According to the CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack vector is local (AV:L), meaning the adversary must already possess logon access to the host infrastructure executing the Oracle HRMS (US) services. The attack complexity is low (AC:L), and the required privileges are low (PR:L), indicating that a standard, unprivileged user account on the host system is sufficient to initiate the attack vector. Furthermore, no user interaction (UI:N) is required for successful exploitation.\nThe attack flow begins with the authenticated low-privileged user leveraging local access to interact with the vulnerable US Payroll Tax Issues component. Due to insufficient access controls, insecure file permissions, or improper handling of internal routines within the component, the attacker can manipulate execution flows or state parameters. By injecting malicious payloads or leveraging insecure local interfaces exposed by the payroll module, the attacker escalates privileges within the application scope. The payload behavior allows the adversary to bypass security boundaries, leading to unauthorized execution of administrative functions. Consequently, this results in the complete takeover of the Oracle HRMS (US) application, granting the attacker full control to read, modify, or delete sensitive payroll data, disrupt operational availability, and compromise the integrity of the broader enterprise resource planning environment."
}