The vulnerability is located in the Internal Operations component of Oracle Payroll. A low‑privileged attacker who can reach the system over HTTP can compromise the application and ultimately take ownership of Oracle Payroll. Successful exploitation results in full confidentiality, integrity, and availability loss, as reflected by the CVSS 3.1 base score of 7.5.

Affected systems are Oracle Corporation’s Oracle Payroll product in versions 12.2.3 through 12.2.15, as identified by the CPU October 2026 advisory.

The CVSS base score of 7.5 indicates significant potential impact, while the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog. The attacker needs only network access via HTTP and no prior authentication. Although the vulnerability is described as difficult to exploit, the remote nature and lack of a hard prerequisite make the risk level high for exposed systems.