The vulnerability resides in Oracle Payroll’s internal operations component, allowing an attacker who needs only low-level network access over HTTP to read any data stored in the payroll system. This is an improper authorization weakness; it requires no credentials beyond basic connectivity, and the impact is a confidentiality breach that could expose employee and financial information.

Oracle Payroll, supported versions 12.2.3 through 12.2.15, as listed by Oracle in the advisory.

The CVSS v3.1 base score of 6.5 indicates a moderate to high confidentiality impact. The EPSS score of 0.00371 (about 0.4%) shows a low, but nonzero, probability of exploitation. The vulnerability is not in the CISA KEV catalog. Attackers would send crafted HTTP requests to the Payroll service, exploiting the low privilege requirement. The lack of additional authentication makes it a reasonably attractive target for organizations exposing the service to external networks. The flaw is structured as CWE-863: Authorization Bypass through Function Level Authorization.