The vulnerability in Oracle Payroll allows an attacker with low privileges who can reach the system over HTTP to compromise the application. Successful exploitation leads to full takeover of Oracle Payroll, enabling the attacker to read, modify, and delete payroll data, disrupt payroll processing, and potentially access other corporate resources. The impact includes a complete loss of confidentiality, integrity, and availability for payroll data and processes.

This issue affects Oracle Payroll, part of Oracle E‑Business Suite, specifically the Internal Operations component. Versions 12.2.3 through 12.2.15 are vulnerable. The vulnerability is present in all builds within this range, regardless of custom configuration.

The CVSS 3.1 base score of 7.5 signals a high severity vulnerability with full confidentiality, integrity, and availability impacts. The attack vector is network‑based via HTTP, requiring the attacker to have low privilege on the system but no special application privilege. While exploitation is described as "difficult", the EPSS score of < 1% suggests a low probability of widespread exploitation, and it is not listed in CISA KEV, indicating it has not yet been widely abused. Yet the potential for destructive outcomes warrants immediate attention. An attacker can potentially achieve full control if they succeed.