{"id":"CVE-2026-101712","kind":"vulnerability","aliases":["CVE-2026-101712"],"related":[],"title":"Oracle Payroll: low-privilege network attacker can take over the product","description":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Payroll inside E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user who can reach it over HTTP can take over the Payroll product, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","package","payroll","self-hosted"],"not_affected_if":["different-release","payroll-not-installed"],"how_to_check":"- Confirm the E-Business Suite release in use, for example by checking the patch level in Oracle Applications Manager or the `$FND_TOP` patch history\n- Check whether the Oracle Payroll module is installed and in use\n- unknown whether a specific patch ID or banner string is exposed by the sources","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses this CVE; the exact patch number is unknown from the sources\n- Move off the affected 12.2.3 through 12.2.15 range to a supported release that includes the fix","status":"open","published_at":"2026-10-20T22:18:25+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:08+00:00","updated_at":"2026-10-25T03:19:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:19:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses this CVE; the exact patch number is unknown from the sources\n- Move off the affected 12.2.3 through 12.2.15 range to a supported release that includes the fix","reach":"network","title":"Oracle Payroll: low-privilege network attacker can take over the product","impact":"high","summary":"Oracle Payroll inside E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user who can reach it over HTTP can take over the Payroll product, with high impact to confidentiality, integrity and availability.","category":"package","nicknames":[],"who_cares":["oracle-ebs","payroll","self-hosted","enterprise-erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over Oracle Payroll, reading and changing payroll data","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number covering CVE-2026-101712, and the exact fixed EBS version, via the Oracle security alerts page.","how_to_check":"- Confirm the E-Business Suite release in use, for example by checking the patch level in Oracle Applications Manager or the `$FND_TOP` patch history\n- Check whether the Oracle Payroll module is installed and in use\n- unknown whether a specific patch ID or banner string is exposed by the sources","needs_analyst":true,"not_affected_if":["different-release","payroll-not-installed"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Payroll product in use are exposed. The attack needs HTTP network access to the Payroll application and a low-privileged account, which is a typical employee-level login. Teams on other E-Business Suite releases or without Payroll can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":3447,"output_tokens":692,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101712':15A,18A '-2026':14A,17A '/av':140C '12.2.15':40B,96C '12.2.3':38B,95C '3.1':127C,139C '7.5':130C 'access':107C 'affect':93C 'allow':101C 'attack':7A,104C,115C 'avail':73B,134C 'base':128C 'busi':35B,84C 'compon':48B,86C 'compromis':111C 'confidenti':70B,131C 'cve':13A,16A 'cvss':126C,136C,138C 'difficult':97C 'e':34B,83C 'e-busi':33B,82C 'eb':24B 'enterpris':20B 'enterprise-erp':19B 'erp':21B 'exploit':99C 'flaw':43B 'h':148C 'h/a':147C 'h/i':146C 'h/pr':142C 'high':67B 'host':29B 'http':59B,109C 'impact':68B,135C 'insid':32B 'integr':71B,132C 'intern':46B,87C 'l/ui':143C 'low':4A,51B,102C 'low-privileg':3A,50B 'n/ac':141C 'n/s':144C 'network':6A,106C 'oper':47B,88C 'oracl':1A,23B,30B,77C,81C,112C,124C 'oracle-eb':22B 'packag':25B 'payrol':2A,26B,31B,64B,78C,113C,125C 'privileg':5A,52B,103C 'product':12A,65B,79C 'reach':56B 'result':120C 'score':129C 'self':28B 'self-host':27B 'success':114C 'suit':36B,85C 'support':89C 'take':9A,61B 'takeov':122C 'u/c':145C 'user':53B 'vector':137C 'version':37B,90C 'via':108C 'vulner':74C,100C,118C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Payroll product in use are exposed. The attack needs HTTP network access to the Payroll application and a low-privileged account, which is a typical employee-level login. Teams on other E-Business Suite releases or without Payroll can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101712","severity":null,"published_at":"2026-10-20T22:18:25+00:00","modified_at":"2026-10-22T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}