Oracle Payroll’s Internal Operations component is vulnerable when accessed over HTTP. A low‑privileged user can exploit an authorization defect that allows a full takeover of the payroll application. This compromise would expose sensitive payroll data and disrupt its integrity and availability.

Oracle Payroll – part of the Oracle E‑Business Suite – is affected for the version range 12.2.3 to 12.2.15. The flaw is present only when the platform’s HTTP interface for Internal Operations is reachable from the network.

The CVSS 3.1 base score of 8.8 underscores the high severity of the issue, while the EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability can be leveraged over the network from any host that can reach the HTTP endpoint and possess low‑privilege credentials, with no user interaction required. The flaw is not listed in the CISA KEV catalog, but a successful attack would represent a complete compromise of the payroll service.