This vulnerability affects Oracle Public Sector Payroll within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is classified under CWE-284 (Improper Access Control). The flaw allows an attacker with high privileges and network access over HTTP to compromise the system, leading to potential full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not yet confirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation can lead to complete compromise of Oracle Public Sector Payroll, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the payroll system, potentially leading to unauthorized data access and manipulation.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Public Sector Payroll systems to trusted users only and monitor for suspicious activity consistent with high privileged access misuse.