{"id":"CVE-2026-101708","kind":"vulnerability","aliases":["CVE-2026-101708"],"related":[],"title":"Oracle E-Business Suite Payroll: low-privilege network attacker can take over","description":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged attacker with network access over HTTP can compromise the Payroll module and take it over.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-ebs","payroll","self-hosted","vendor"],"not_affected_if":["payroll-not-installed"],"how_to_check":"- Identify the E-Business Suite release in use and whether the Oracle Payroll module is installed\n- Compare the installed release against the affected range `12.2.3` to `12.2.15`","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Payroll in E-Business Suite, as listed in Oracle's advisory (version unknown from sources)","status":"open","published_at":"2026-10-20T22:18:25+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:08+00:00","updated_at":"2026-10-25T03:19:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:19:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Payroll in E-Business Suite, as listed in Oracle's advisory (version unknown from sources)","reach":"network","title":"Oracle E-Business Suite Payroll: low-privilege network attacker can take over","impact":"high","summary":"Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged attacker with network access over HTTP can compromise the Payroll module and take it over.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","payroll","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Payroll, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level and any workaround; the NVD entry gives no fix version.","how_to_check":"- Identify the E-Business Suite release in use and whether the Oracle Payroll module is installed\n- Compare the installed release against the affected range `12.2.3` to `12.2.15`","needs_analyst":true,"not_affected_if":["payroll-not-installed"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Payroll module installed and reachable over HTTP. Sites without Payroll, or on releases outside the stated range, are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3447,"output_tokens":555,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101708':16A,19A '-2026':15A,18A '/av':130C '12.2.15':38B,86C '12.2.3':36B,85C '3.1':117C,129C '7.5':120C 'access':54B,97C 'affect':83C 'allow':91C 'attack':11A,51B,94C,105C 'avail':124C 'base':118C 'busi':4A,33B,74C 'compon':46B,76C 'compromis':58B,101C 'confidenti':121C 'cve':14A,17A 'cvss':116C,126C,128C 'difficult':87C 'e':3A,32B,73C 'e-busi':2A,31B,72C 'eb':22B 'exploit':89C 'flaw':41B 'h':138C 'h/a':137C 'h/i':136C 'h/pr':132C 'host':26B 'http':56B,99C 'impact':125C 'integr':122C 'intern':44B,77C 'l/ui':133C 'low':8A,49B,92C 'low-privileg':7A,48B 'modul':61B 'n/ac':131C 'n/s':134C 'network':10A,53B,96C 'oper':45B,78C 'oracl':1A,21B,28B,67C,71C,102C,114C 'oracle-eb':20B 'payrol':6A,23B,29B,60B,68C,103C,115C 'privileg':9A,50B,93C 'product':69C 'result':110C 'score':119C 'self':25B 'self-host':24B 'success':104C 'suit':5A,34B,75C 'support':79C 'take':13A,63B 'takeov':112C 'u/c':135C 'vector':127C 'vendor':27B 'version':35B,80C 'via':98C 'vulner':64C,90C,108C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Payroll module installed and reachable over HTTP. Sites without Payroll, or on releases outside the stated range, are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101708","severity":null,"published_at":"2026-10-20T22:18:25+00:00","modified_at":"2026-10-22T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}