This vulnerability affects Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the Oracle Payroll system. The vulnerability can lead to unauthorized access to critical or all data accessible by Oracle Payroll. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle’s August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple Oracle products.

Successful exploitation can result in unauthorized access to critical or complete Oracle Payroll data. The vulnerability’s scope change means it may also affect additional Oracle products beyond Oracle Payroll. The CVSS score of 7.7 reflects a high impact on confidentiality with no impact on integrity or availability. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigation or temporary fix is indicated in the advisory.