This vulnerability affects Oracle Payroll in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an attacker with low privileges and network access over HTTP to compromise the payroll system, resulting in unauthorized access to sensitive payroll data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly advises applying security patches from Critical Patch Updates to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Payroll, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability requires network access via HTTP and low privileges, making it moderately exploitable. No known public exploits have been reported so far.

Oracle has not explicitly confirmed a specific patch for CVE-2026-61250 in the provided advisory, but it is included in the July 2026 Critical Patch Update collection. Oracle strongly recommends applying the latest Critical Patch Updates promptly to mitigate this and other vulnerabilities. Until a patch is applied, restrict network access to Oracle Payroll interfaces where possible to limit exposure. Monitor Oracle security advisories for updates on remediation status.