This vulnerability affects Oracle Public Sector Payroll within Oracle E-Business Suite, specifically versions 12.2.4 to 12.2.15. It permits a high privileged attacker with network access over HTTP to compromise the system, potentially leading to complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update advisory references a large set of patches across many products but does not explicitly confirm patch availability or remediation status for this specific vulnerability and product version.

Successful exploitation can lead to full compromise of Oracle Public Sector Payroll, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the payroll system, potentially leading to unauthorized access to sensitive payroll data and disruption of payroll operations.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. No explicit vendor advisory states that no action is required or that the issue is already mitigated, so organizations should monitor Oracle's updates and apply patches as soon as they become available.