The vulnerability resides in Oracle Payroll’s internal operations component. A low‑privileged attacker who can reach the application over HTTP can exploit the flaw and take control of the payroll system. The exploit requires only network access and offers no user interaction, resulting in full compromise that impacts confidentiality, integrity, and availability.

Oracle Corporation’s Oracle Payroll product, part of Oracle E‑Business Suite. The affected releases are 12.2.3 through 12.2.15. These versions are still supported and vulnerable to the described exploitation.

The CVSS score of 7.5 indicates high severity. The exploit can be attempted over the network and does not require exploitation of existing credentials, making it attractive to low‑privilege adversaries. The EPSS score is unknown, and the vulnerability is not listed in the CISA KEV catalog, but the attack vector and impact warrant immediate attention.