A vulnerability in Oracle Payroll allows an attacker with low‑privileged network access over HTTPS to compromise the application. The flaw is based on missing authentication, enabling the attacker to gain full control of Payroll and cause confidentiality, integrity, and availability violations, as indicated by a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Oracle Corporation’s Oracle Payroll product, part of the Oracle E‑Business Suite. Supported releases affected by this issue are versions 12.2.3 through 12.2.15. The vulnerability is exploitable via the Internal Operations component when accessed over HTTPS.

The CVSS base score of 8.8 classifies this as a high‑severity flaw. EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTPS connection, and the attack requires only low‑privileged credentials or the absence of strict authentication controls. An attacker gaining success can take over the Payroll system, endangering all sensitive business data.