This vulnerability affects Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows an attacker with low privileges and network access over HTTP to compromise the Oracle Payroll system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack can be performed remotely with low attack complexity and privileges, without user interaction, and results in high confidentiality, integrity, and availability impacts. The vulnerability relates to weaknesses in internal operations of Oracle Payroll. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this specific vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Payroll, affecting confidentiality, integrity, and availability of the system. An attacker could gain unauthorized access and control over Oracle Payroll operations, potentially leading to data breaches, manipulation of payroll data, and disruption of payroll services.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. Although no explicit patch or remediation level is confirmed for this vulnerability in the advisory, customers should monitor Oracle's official security alerts and apply relevant patches as they become available. Until a patch is confirmed, organizations should restrict network access to Oracle Payroll systems and apply compensating controls to limit exposure. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.