CVE-2026-62464 affects Oracle Payroll in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the Oracle Payroll component. Successful exploitation can result in full takeover of Oracle Payroll, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. Oracle recommends applying security patches without delay to mitigate exploitation risks.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Payroll, resulting in complete takeover of the product. This impacts confidentiality, integrity, and availability of the Oracle Payroll system, potentially exposing sensitive payroll data and disrupting payroll operations.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple security vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-62464, Oracle strongly recommends that customers remain on actively-supported versions and apply all available security patches promptly. Patch status for this specific vulnerability is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.