---
id: "CVE-2026-101711"
kind: "vulnerability"
aliases: ["CVE-2026-101711"]
title: "Oracle E-Business Suite Payroll: high-privileged attacker can take over over HTTP"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["oracle-ebs", "package", "payroll", "self-hosted"]
not_affected_if: ["payroll-not-installed", "versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:25+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:46:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101711", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite Payroll: high-privileged attacker can take over over HTTP

Oracle E-Business Suite's Payroll component, versions 12.2.3 through 12.2.15, has a flaw that lets a highly privileged attacker on the network reach it over HTTP. A successful attack can lead to full takeover of Oracle Payroll.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use, for example by checking the installed Payroll patch level or the release in the Applications Dashboard
- Check whether the Payroll product is installed and reachable over HTTP from the network

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-101711 for Oracle E-Business Suite 12.2.3 through 12.2.15 (patch number unknown from the sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101711

## From the sources

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_