---
id: "CVE-2026-101556"
kind: "vulnerability"
aliases: ["CVE-2026-101556"]
title: "Oracle E-Business Suite Payroll: low-privilege network attacker can take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle E-Business Suite Payroll", "fixed": ["October 2026 CPU patch (number in MOS)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["http", "oracle-ebs", "payroll", "self-hosted", "vendor"]
not_affected_if: ["oct-2026-cpu-applied", "payroll-not-installed", "unknown"]
published_at: "2026-10-20T22:18:05+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:26:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101556", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:26:55+00:00"}]
---

# Oracle E-Business Suite Payroll: low-privilege network attacker can take over

Oracle Payroll inside E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component that can be reached over HTTP. A low-privileged attacker with network access can take over the Payroll application, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Payroll affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU patch (number in MOS)

## How to check

Run the EBS CPU Checker (ECPUC, Patch 35583866): run ECPUC.sql and read ECPUC.lst for your current CPU/CSPU level and missing patches. Any 12.2.3-12.2.15 install without the Oct 2026 CPU is exposed.

## Fix

Apply the Oracle E-Business Suite October 2026 CPU (or later CSPU) for Release 12.2; find the current patch via MOS Article KA923. Exact patch number unknown (needs MOS login).

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101556
- 2026-10-25T03:26:55+00:00 analyst — Fixed in Oracle October 2026 CPU (20 Oct 2026; EBS row 12.2.3-12.2.15). Specific patch number is in MOS (KA923), not public; per-CVE risk matrix not read. No exploitation or PoC found; not in KEV. Sibling Payroll CVEs (101708-101712) exist.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] October 2026 Updates to EBS Critical Patch Update Checker (ECPUC) https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc
- [fix] Critical Patch Update for October 2026 Now Available (EBS) https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available

## From the sources

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_