This vulnerability affects Oracle Payroll in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTPS to compromise the Oracle Payroll component, potentially leading to complete takeover. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability. The vulnerability is addressed in Oracle's May 2026 Critical Security Patch Update, which includes 35 new security patches across multiple Oracle products. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing privileges may reduce risk temporarily but do not fix the underlying issue. The vendor advisory does not indicate any known active exploitation.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Payroll, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over Oracle Payroll functions, potentially disrupting payroll operations and exposing sensitive payroll data. No known exploits in the wild have been reported so far.

Oracle has released security patches for this vulnerability as part of the May 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, but these are temporary measures and may impact functionality. Oracle strongly recommends testing any such changes in non-production environments. Staying on supported product versions and promptly applying security patches is critical.