This vulnerability in Oracle Payroll (component: Internal Operations) allows an attacker with low privileges and network access over HTTP to compromise the Oracle Payroll system. The affected versions explicitly include 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly state a patch or fix for this specific vulnerability in Oracle Payroll. The advisory emphasizes applying patches promptly but does not provide direct remediation details for this CVE. No exploits are currently known in the wild.

Successful exploitation can lead to complete compromise of Oracle Payroll, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over Oracle Payroll operations, potentially affecting payroll data and related business processes.

Oracle's advisory strongly recommends applying security patches without delay to supported products. However, the advisory content provided does not explicitly confirm the availability of a patch or official fix for this vulnerability in Oracle Payroll. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle Payroll interfaces to trusted users and monitor for unusual activity consistent with exploitation attempts.