This vulnerability affects Oracle Public Sector Payroll within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It enables a low privileged attacker with network access via HTTP to exploit the product easily, leading to complete compromise of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions a broad set of patches but does not explicitly confirm patch availability or remediation details for this CVE. The vendor strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can lead to full takeover of Oracle Public Sector Payroll, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive payroll data, modify or disrupt payroll operations, and potentially escalate privileges within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's Critical Patch Update advisory for July 2026 should be monitored closely for patch availability specific to this vulnerability. Oracle recommends applying all relevant security patches without delay and remaining on actively supported product versions to reduce risk.