The vulnerability is present in the Oracle Payroll component of Oracle E-Business Suite, allowing a low privileged attacker who has network access via HTTP to compromise the application. Successful exploitation can lead to full takeover of Oracle Payroll, resulting in confidentiality, integrity and availability loss for the affected organization. The CVSS 3.1 base score of 7.5 indicates a high severity with impacts on all data security dimensions. The attack occurs remotely over the network with a high attack complexity requirement, but only a low privileged user is needed. This reflects a serious breach potential, especially in environments where Payroll contains sensitive financial and personnel data.

Affected vendors and products include Oracle Corporation’s Oracle Payroll service. The vulnerability affects Oracle Payroll versions from 12.2.3 up through 12.2.15. No additional versions or iterated releases are specified in the current advisory.

The CVSS rating of 7.5 places the vulnerability in the high severity bracket, while the EPSS score is not available, and it has not been listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP request that a low privileged attacker can initiate, exploiting an underlying flaw that permits takeover of Oracle Payroll. Because the flaw requires network access and a low privileged account but has a high attack complexity, the risk remains significant for organizations running the vulnerable payroll service, particularly if HTTP access is publicly or widely available.