Description
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Oracle Public Sector Payroll component of Oracle E‑Business Suite, where an internal operations interface fails to enforce proper access control (CWE-284). An attacker possessing high‑privileged credentials and network access over HTTP can exploit this weakness to compromise the payroll system, resulting in full takeover that jeopardizes confidentiality, integrity, and availability.

Affected Systems

Oracle Public Sector Payroll, a component of Oracle E‑Business Suite, is affected for versions 12.2.3 through 12.2.15. The issue is limited to this payroll component and does not extend to other parts of the suite.

Risk and Exploitability

The CVSS v3.1 base score of 7.2 indicates a medium‑to‑high severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a crafted HTTP request to the Internal Operations interface while holding high‑privileged credentials, after which the flaw is easily leveraged for takeover.

Generated by OpenCVE AI on August 4, 2026 at 02:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Consult Oracle’s July 2026 CPU advisory (https://www.oracle.com/security-alerts/cpujul2026.html) and apply any patches or updates released for Oracle Public Sector Payroll.
  • Restrict HTTP access to the Internal Operations component to trusted IP addresses or internal network segments using firewalls or VPNs.
  • Enforce least privilege for users who can manage Payroll configurations to prevent high‑level access from untrusted accounts.

Generated by OpenCVE AI on August 4, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title High‑Privilege Access Control Failure in Oracle Public Sector Payroll

Thu, 30 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title High‑Privilege Access Control Failure in Oracle Public Sector Payroll

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Oracle Public Sector Payroll Vulnerability Allowing High‑Privilege Takeover via HTTP

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Oracle Public Sector Payroll Vulnerability Allowing High‑Privilege Takeover via HTTP

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle public Sector Payroll
CPEs cpe:2.3:a:oracle:public_sector_payroll:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle public Sector Payroll
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Public Sector Payroll
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T17:05:07.555Z

Reserved: 2026-07-08T15:51:55.602Z

Link: CVE-2026-60926

cve-icon Vulnrichment

Updated: 2026-07-24T17:05:00.365Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-21T22:18:27.687

Modified: 2026-07-24T18:18:06.763

Link: CVE-2026-60926

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:30:02Z

Weaknesses