The vulnerability is a low privileged network access flaw in the Internal Operations component of Oracle Payroll. An attacker with network connectivity via HTTP and only low privileges can exploit this flaw to compromise the payroll system, potentially taking full control of Oracle Payroll and accessing confidential payroll data. The weakness permits full confidentiality, integrity, and availability damage.

Affected product: Oracle Payroll, part of Oracle E‑Business Suite, version range 12.2.3 through 12.2.15 as supported by the vendor. No other explicit vendor products are enumerated.

The CVSS 3.1 Base score is 7.5, which indicates a high severity. EPSS score is not available, so the real-world exploitation probability cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog. Attack vectors are inferred to be network based via HTTP, exploiting low privilege accounts. Given the CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, remote attackers with low privilege could achieve full compromise if the vulnerability is successful.