{"id":"CVE-2026-101711","kind":"vulnerability","aliases":["CVE-2026-101711"],"related":[],"title":"Oracle E-Business Suite Payroll: high-privileged attacker can take over over HTTP","description":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Payroll component, versions 12.2.3 through 12.2.15, has a flaw that lets a highly privileged attacker on the network reach it over HTTP. A successful attack can lead to full takeover of Oracle Payroll.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-ebs","package","payroll","self-hosted"],"not_affected_if":["payroll-not-installed","versions-outside-12.2.3-12.2.15"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use, for example by checking the installed Payroll patch level or the release in the Applications Dashboard\n- Check whether the Payroll product is installed and reachable over HTTP from the network","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101711 for Oracle E-Business Suite 12.2.3 through 12.2.15 (patch number unknown from the sources)","status":"open","published_at":"2026-10-20T22:18:25+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:46:53+00:00","updated_at":"2026-10-25T03:46:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:46:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-101711 for Oracle E-Business Suite 12.2.3 through 12.2.15 (patch number unknown from the sources)","reach":"network","title":"Oracle E-Business Suite Payroll: high-privileged attacker can take over over HTTP","impact":"high","summary":"Oracle E-Business Suite's Payroll component, versions 12.2.3 through 12.2.15, has a flaw that lets a highly privileged attacker on the network reach it over HTTP. A successful attack can lead to full takeover of Oracle Payroll.","category":"package","nicknames":[],"who_cares":["oracle-ebs","payroll","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Oracle Payroll application, reading and changing data","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number for CVE-2026-101711 on oracle.com security alerts; sources give no fix version.","how_to_check":"- Confirm the Oracle E-Business Suite release in use, for example by checking the installed Payroll patch level or the release in the Applications Dashboard\n- Check whether the Payroll product is installed and reachable over HTTP from the network","needs_analyst":true,"not_affected_if":["payroll-not-installed","versions-outside-12.2.3-12.2.15"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Payroll product installed. Exploitation needs a highly privileged account with network access, so exposure is limited to deployments where such accounts are reachable. Teams without Oracle E-Business Suite Payroll can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000668,"input_tokens":3444,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101711':18A,21A '-2026':17A,20A '/av':134C '12.2.15':41B,90C '12.2.3':39B,89C '3.1':121C,133C '6.6':124C 'access':101C 'affect':87C 'allow':95C 'attack':10A,50B,60B,98C,109C 'avail':128C 'base':122C 'busi':4A,33B,79C 'compon':37B,81C 'compromis':105C 'confidenti':125C 'cve':16A,19A 'cvss':120C,130C,132C 'difficult':91C 'e':3A,32B,78C 'e-busi':2A,31B,77C 'eb':24B 'exploit':93C 'flaw':44B 'full':64B 'h':142C 'h/a':141C 'h/i':140C 'h/pr':136C 'h/ui':137C 'high':8A,48B,96C 'high-privileg':7A 'host':29B 'http':15A,57B,103C 'impact':129C 'integr':126C 'lead':62B 'let':46B 'n/ac':135C 'n/s':138C 'network':53B,100C 'oracl':1A,23B,30B,67B,72C,76C,106C,118C 'oracle-eb':22B 'packag':25B 'payrol':6A,26B,36B,68B,73C,82C,107C,119C 'privileg':9A,49B,97C 'product':74C 'reach':54B 'result':114C 'score':123C 'self':28B 'self-host':27B 'success':59B,108C 'suit':5A,34B,80C 'support':83C 'take':12A 'takeov':65B,116C 'u/c':139C 'vector':131C 'version':38B,84C 'via':102C 'vulner':69C,94C,112C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Payroll product installed. Exploitation needs a highly privileged account with network access, so exposure is limited to deployments where such accounts are reachable. Teams without Oracle E-Business Suite Payroll can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101711","severity":null,"published_at":"2026-10-20T22:18:25+00:00","modified_at":"2026-10-22T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}