---
id: "CVE-2026-87363"
kind: "vulnerability"
aliases: ["CVE-2026-87363"]
title: "Oracle E-Business Suite Payroll: low-privileged network attacker can take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-ebs", "payroll", "self-hosted", "vendor"]
not_affected_if: ["no-ebs-payroll"]
published_at: "2026-10-20T22:20:14+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87363", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle E-Business Suite Payroll: low-privileged network attacker can take over

Oracle Payroll in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user reaching it over HTTP can fully compromise the Payroll application, per the NVD description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Oracle E-Business Suite with the Payroll module is installed and which release it runs, e.g. the `12.2.x` version shown in Oracle Applications Manager or the release notes.
- Check Oracle's Security Alert advisory for the patch level covering this CVE; the sources do not name the patch.

## Fix

- Apply the Oracle Critical Patch Update or security patch that addresses CVE-2026-87363 for E-Business Suite Payroll (fixed release unknown from the sources).
- Until patched, restrict HTTP access to the Payroll pages to trusted internal users (unknown from the sources whether this fully mitigates).

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87363

## From the sources

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_