The vulnerability is present in the Oracle Payroll component of Oracle E‑Business Suite, allowing a low‑privileged attacker who has network access via HTTP to compromise the application. Successful exploitation can lead to full takeover of Oracle Payroll, resulting in confidentiality, integrity and availability loss for the affected organization. The CVSS 3.1 base score of 7.5 indicates a high severity with impacts on all data security dimensions. The attack occurs remotely over the network with a high attack complexity requirement, but only a low‑privileged user is needed. This reflects a serious breach potential, especially in environments where Payroll contains sensitive financial and personnel data. The type of weakness corresponds to CWE‑284 (Improper Access Control).

Affected vendors and products include Oracle Corporation’s Oracle Payroll service. The vulnerability affects Oracle Payroll versions from 12.2.3 up through 12.2.15. No additional versions or iterated releases are specified in the current advisory.

The CVSS rating of 7.5 places the vulnerability in the high severity bracket, and the EPSS score of < 1% indicates a low exploitation probability, while it has not been listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP request that a low‑privileged attacker can initiate, exploiting an underlying flaw that permits takeover of Oracle Payroll. Because the flaw requires network access and a low privileged account but has a high attack complexity, the risk remains significant for organizations running the vulnerable payroll service, particularly if HTTP access is publicly or widely available.