---
id: "CVE-2026-101712"
kind: "vulnerability"
aliases: ["CVE-2026-101712"]
title: "Oracle Payroll: low-privilege network attacker can take over the product"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["enterprise-erp", "oracle-ebs", "package", "payroll", "self-hosted"]
not_affected_if: ["different-release", "payroll-not-installed"]
published_at: "2026-10-20T22:18:25+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:19:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101712", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Payroll: low-privilege network attacker can take over the product

Oracle Payroll inside E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user who can reach it over HTTP can take over the Payroll product, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the E-Business Suite release in use, for example by checking the patch level in Oracle Applications Manager or the `$FND_TOP` patch history
- Check whether the Oracle Payroll module is installed and in use
- unknown whether a specific patch ID or banner string is exposed by the sources

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite that addresses this CVE; the exact patch number is unknown from the sources
- Move off the affected 12.2.3 through 12.2.15 range to a supported release that includes the fix

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101712

## From the sources

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_