CVE-2026-46828
Oracle Payroll Data Manipulation Vulnerability in Oracle E-Business Suite
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | payroll | From 12.2.3 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Payroll product of the Oracle E-Business Suite, specifically in the Internal Operations component. It affects supported versions 12.2.3 through 12.2.15. The flaw is easily exploitable by a low privileged attacker who has network access via HTTP.
An attacker exploiting this vulnerability can compromise Oracle Payroll, gaining unauthorized capabilities such as creating, deleting, or modifying critical data or any data accessible within Oracle Payroll.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized creation, deletion, or modification of critical data within Oracle Payroll. An attacker could gain complete unauthorized access to all data accessible by Oracle Payroll.
This could lead to significant data integrity and confidentiality breaches, potentially disrupting payroll operations and exposing sensitive employee or organizational information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Payroll, as well as unauthorized access to all Oracle Payroll accessible data. Such unauthorized access and data manipulation can lead to violations of data protection requirements mandated by standards like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive personal and payroll data.
Therefore, exploitation of this vulnerability could result in non-compliance with regulations that mandate protection of personal and financial data, potentially leading to legal and financial consequences.