Threats affecting pkg:maven/com.oracle/OraclePublicSectorPayroll

CVE-2026-62476 is a high-severity vulnerability in Oracle Public Sector Payroll versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has published a Critical Patch Update advisory in July 2026 that includes multiple security patches, but specific patch availability for this vulnerability is not explicitly confirmed in the advisory.

CVE-2026-46976 is a high-severity vulnerability in Oracle Public Sector Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update but has not explicitly stated a dedicated patch for this CVE in the advisory. Oracle strongly recommends applying the Critical Security Patch Update promptly to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, though these may affect functionality.