{"id":"CVE-2026-87363","kind":"vulnerability","aliases":["CVE-2026-87363"],"related":[],"title":"Oracle E-Business Suite Payroll: low-privileged network attacker can take over","description":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user reaching it over HTTP can fully compromise the Payroll application, per the NVD description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-ebs","payroll","self-hosted","vendor"],"not_affected_if":["no-ebs-payroll"],"how_to_check":"- Confirm whether Oracle E-Business Suite with the Payroll module is installed and which release it runs, e.g. the `12.2.x` version shown in Oracle Applications Manager or the release notes.\n- Check Oracle's Security Alert advisory for the patch level covering this CVE; the sources do not name the patch.","fix":"- Apply the Oracle Critical Patch Update or security patch that addresses CVE-2026-87363 for E-Business Suite Payroll (fixed release unknown from the sources).\n- Until patched, restrict HTTP access to the Payroll pages to trusted internal users (unknown from the sources whether this fully mitigates).","status":"open","published_at":"2026-10-20T22:20:14+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:48+00:00","updated_at":"2026-10-25T03:18:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update or security patch that addresses CVE-2026-87363 for E-Business Suite Payroll (fixed release unknown from the sources).\n- Until patched, restrict HTTP access to the Payroll pages to trusted internal users (unknown from the sources whether this fully mitigates).","reach":"network","title":"Oracle E-Business Suite Payroll: low-privileged network attacker can take over","impact":"high","summary":"Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user reaching it over HTTP can fully compromise the Payroll application, per the NVD description.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","payroll","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Payroll application, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed release and any mitigation for CVE-2026-87363; the NVD entry alone gives no patch version.","how_to_check":"- Confirm whether Oracle E-Business Suite with the Payroll module is installed and which release it runs, e.g. the `12.2.x` version shown in Oracle Applications Manager or the release notes.\n- Check Oracle's Security Alert advisory for the patch level covering this CVE; the sources do not name the patch.","needs_analyst":true,"not_affected_if":["no-ebs-payroll"],"who_is_affected":"Organizations running Oracle E-Business Suite Payroll in the affected range 12.2.3 through 12.2.15 that expose its web interface to users with any account. Attack complexity is high, so exploitation needs specific conditions the sources do not describe. Teams without Oracle E-Business Suite Payroll can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":3447,"output_tokens":697,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87363':16A,19A '/av':132C '12.2.15':38B,88C '12.2.3':36B,87C '3.1':119C,131C '7.5':122C 'access':99C 'affect':85C 'allow':93C 'applic':61B 'attack':11A,96C,107C 'avail':126C 'base':120C 'busi':4A,33B,76C 'compon':46B,78C 'compromis':58B,103C 'confidenti':123C 'cve':14A,17A 'cvss':118C,128C,130C 'descript':65B 'difficult':89C 'e':3A,32B,75C 'e-busi':2A,31B,74C 'eb':22B 'exploit':91C 'flaw':41B 'fulli':57B 'h':140C 'h/a':139C 'h/i':138C 'h/pr':134C 'host':26B 'http':55B,101C 'impact':127C 'integr':124C 'intern':44B,79C 'l/ui':135C 'low':8A,49B,94C 'low-privileg':7A,48B 'n/ac':133C 'n/s':136C 'network':10A,98C 'nvd':64B 'oper':45B,80C 'oracl':1A,21B,28B,69C,73C,104C,116C 'oracle-eb':20B 'payrol':6A,23B,29B,60B,70C,105C,117C 'per':62B 'privileg':9A,50B,95C 'product':71C 'reach':52B 'result':112C 'score':121C 'self':25B 'self-host':24B 'success':106C 'suit':5A,34B,77C 'support':81C 'take':13A 'takeov':114C 'u/c':137C 'user':51B 'vector':129C 'vendor':27B 'version':35B,82C 'via':100C 'vulner':66C,92C,110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite Payroll in the affected range 12.2.3 through 12.2.15 that expose its web interface to users with any account. Attack complexity is high, so exploitation needs specific conditions the sources do not describe. Teams without Oracle E-Business Suite Payroll can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87363","severity":null,"published_at":"2026-10-20T22:20:14+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}