---
id: "CVE-2026-101708"
kind: "vulnerability"
aliases: ["CVE-2026-101708"]
title: "Oracle E-Business Suite Payroll: low-privilege network attacker can take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-ebs", "payroll", "self-hosted", "vendor"]
not_affected_if: ["payroll-not-installed"]
published_at: "2026-10-20T22:18:25+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:19:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101708", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite Payroll: low-privilege network attacker can take over

Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged attacker with network access over HTTP can compromise the Payroll module and take it over.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify the E-Business Suite release in use and whether the Oracle Payroll module is installed
- Compare the installed release against the affected range `12.2.3` to `12.2.15`

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Payroll in E-Business Suite, as listed in Oracle's advisory (version unknown from sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101708

## From the sources

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_