The Oracle Payroll product in Oracle E-Business Suite is vulnerable, allowing a low privileged attacker who can reach the system over HTTP to take complete control of Oracle Payroll. The vulnerability can be exploited to compromise confidentiality, integrity, and availability by allowing the attacker to execute arbitrary code or commands with the privileges of the payroll service. The impact can include full takeover of payroll functionality.

Oracle Payroll versions 12.2.3 through 12.2.15 are affected. Only the Internal Operations component of Oracle E-Business Suite is impacted.

The CVSS v3.1 base score is 7.5, indicating a high severity vulnerability that can be reached over a network via HTTP. EPSS score is < 1% and indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access over HTTP to the payroll application, and the exploitation prerequisites include a low privileged user on the network and the ability to manipulate HTTP requests. Once exploited, a successful attack results in complete takeover of Oracle Payroll.