This vulnerability exists in the Internal Operations component of Oracle Public Sector Payroll within Oracle E-Business Suite. It is exploitable remotely over the network with low attack complexity and requires high privileges but no user interaction. Successful exploitation can result in complete compromise of the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, indicating high severity. The affected versions explicitly include 12.2.4 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory mentions a large number of patches across many products but does not explicitly confirm a patch for this vulnerability in the provided excerpt.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to take over Oracle Public Sector Payroll. This results in full compromise of the system, affecting confidentiality, integrity, and availability of the application and its data.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Public Sector Payroll to trusted users and monitor for suspicious activity related to high privilege accounts.