This vulnerability affects Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise Oracle Payroll. The vulnerability impacts confidentiality severely, potentially allowing unauthorized access to critical or all data accessible by Oracle Payroll. The vulnerability also has scope change implications, meaning exploitation may impact other Oracle products beyond Oracle Payroll. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privilege required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Payroll. The vulnerability affects confidentiality with no reported impact on integrity or availability. Due to scope change, other Oracle products may also be impacted by attacks exploiting this vulnerability.

Oracle has published a Critical Patch Update advisory in July 2026 that includes many security patches. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-61142. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.