The flaw resides in the Oracle Payroll component of Oracle E-Business Suite and permits a low privileged attacker who can log onto the infrastructure where the application runs to compromise the Payroll system. When successfully exploited, the attacker can take over Oracle Payroll, leading to loss of confidentiality, integrity, and availability of payroll data. This local privilege escalation can develop into full control of the application.

Oracle Payroll, part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15 are affected. No other Oracle products or components are listed as impacted.

With a CVSS base score of 7.0, the vulnerability carries moderate severity but high impact on confidentiality, integrity, and availability. The attack vector is local with low privileges and requires no user interaction, making it exploitable by an attacker who has already accessed the underlying infrastructure. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, indicating no known public exploitation but a high potential impact if exploited.