---
id: "CVE-2026-83360"
kind: "vulnerability"
aliases: ["CVE-2026-83360"]
title: "Oracle E-Business Suite: Korean Payroll flaw exposes HRMS data to low-privileged users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hrms", "oracle-ebs", "payroll", "self-hosted", "vendor"]
not_affected_if: ["no-korean-payroll", "not-ebs-12.2.3-12.2.15"]
published_at: "2026-10-20T22:19:52+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:51:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83360", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite: Korean Payroll flaw exposes HRMS data to low-privileged users

Oracle E-Business Suite's Oracle HRMS (Republic of Korea) product, in its Korean Payroll component, has a flaw that lets an attacker with a low-privileged account reach HRMS data over HTTP. Successful exploitation gives unauthorized read access to critical payroll and HR data, with no integrity or availability impact per the CVSS vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release level for the Oracle HRMS (Republic of Korea) product, looking for `12.2.3` through `12.2.15`
- Confirm whether the Korean Payroll component is in use in your environment
- unknown for other checks, as the sources do not say

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Oracle HRMS (Republic of Korea) that covers this CVE
- unknown for specific patch number or target version, as the sources do not say

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83360

## From the sources

Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Republic of Korea).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (Republic of Korea) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_