This vulnerability affects Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Payroll. Exploitation can result in unauthorized access to critical or all data accessible by Oracle Payroll. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) references multiple patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not confirmed and should be verified in the vendor advisory.

Successful exploitation allows unauthorized access to critical or all data accessible by Oracle Payroll. The vulnerability affects confidentiality with no impact on integrity or availability. The scope change indicates that other products beyond Oracle Payroll may also be impacted by attacks leveraging this vulnerability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict logon access to the infrastructure hosting Oracle Payroll to trusted users only.