This vulnerability allows an adversary with low privileges and HTTP network access to change, delete, or create Payroll data by exploiting the Element Types, Links, and Entries component. The weakness is an improper access control flaw, exposing the system to integrity violations. Successful exploitation results in unauthorized manipulation of critical payroll records. The CVE specifies a CVSS 3.1 base score of 6.5 with high integrity impact.

Oracle Payroll product of Oracle E‑Business Suite, specifically supported versions 12.2.3 through 12.2.15, is affected. Attacks require only network connectivity to the HTTP interface of the Payroll component.

The CVSS score of 6.5 indicates a medium severity risk. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified here, but the vulnerability is described as easily exploitable. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over HTTP, as the vulnerability is described as exploitable by a low‑privileged attacker with network access. The impact is confined to integrity and does not affect confidentiality or availability.