This vulnerability in Oracle Payroll (component Internal Operations) allows a low‑privileged attacker with network access over HTTP to create, delete or modify critical payroll data. The weakness enables unauthorized access to all payroll information, leading to significant confidentiality and integrity breaches. The attack could result in unauthorized data modification or full data compromise.

Oracle Corporation's Oracle Payroll product of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15.

The CVSS v3.1 base score is 6.8, indicating high confidentiality and integrity impact. EPSS score of <1% indicates a very low probability of exploitation, but the lack of an attacker‑controlled user interface and the need for network access over HTTP mean the vulnerability is exploitable from remote positions but requires a valid attacker account with low privileges. The vulnerability is not listed in the CISA KEV catalog at this time, suggesting it is not a widely discovered exploit. The likely attack vector is network‑based via HTTP against the Payroll component.