This vulnerability exists in the Internal Operations component of Oracle Payroll within Oracle E-Business Suite. It is exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Payroll. The vulnerability can lead to complete compromise of Oracle Payroll and may affect other Oracle products due to scope change. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impacts on confidentiality, integrity, and availability. Affected versions are from 12.2.3 up to and including 12.2.15.

An attacker with low privileges and logon access to the Oracle Payroll infrastructure can fully compromise Oracle Payroll, potentially leading to takeover of the component. Due to scope change, the impact may extend to other Oracle products integrated with Oracle Payroll. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. Since this is not a cloud service, patching must be performed by the customer following Oracle's advisory instructions.