Description
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Element Types, Links, Entries). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification of payroll data (integrity)
Action: Patch
AI Analysis

Impact

Vulnerability in the Element Types, Links, and Entries component of Oracle Payroll allows an attacker with low privileges and network access to create, delete, or modify payroll records. The flaw is an improper access control issue (CWE‑863) that can be leveraged to alter critical payroll data without needing higher privileges, compromising data integrity.

Affected Systems

Oracle Payroll product of Oracle E‑Business Suite, supported versions 12.2.3 through 12.2.15, are affected. The vulnerability is reachable via the HTTP interface of the Payroll application.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates medium severity with high integrity impact. The EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote over HTTP, requiring only network access to the Payroll service. Successful exploitation can result in unauthorized manipulation of payroll data but does not affect confidentiality or availability.

Generated by OpenCVE AI on November 5, 2026 at 18:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security update that addresses this access control issue as soon as it is available.
  • Restrict access to the Payroll HTTP interface, for example by limiting traffic to trusted internal networks or enforcing VPN access.
  • Monitor Payroll logs for abnormal creation, modification, or deletion activity and alert on such events.

Generated by OpenCVE AI on November 5, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Title Low‑privilege HTTP exploitation that permits unauthorized payroll data modification
Weaknesses CWE-284

Thu, 05 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Low‑privilege HTTP exploitation that permits unauthorized payroll data modification
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Element Types, Links, Entries). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle payroll
CPEs cpe:2.3:a:oracle:payroll:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle payroll
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Payroll
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T19:27:46.336Z

Reserved: 2026-09-28T15:40:09.491Z

Link: CVE-2026-101553

cve-icon Vulnrichment

Updated: 2026-11-06T19:27:28.838Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:04.923

Modified: 2026-11-06T20:17:06.977

Link: CVE-2026-101553

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T18:15:14Z

Weaknesses