CVE-2026-60893

Awaiting Analysis Awaiting Analysis - Queue

Oracle Payroll Unauthorized Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60893

EUVD

EUVD-2026-47169

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	payroll	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Payroll within Oracle E-Business Suite. It allows a low-privileged attacker with local access to compromise the Payroll component. The issue may also impact other products due to scope changes. Successful exploitation could lead to unauthorized access to critical or all accessible data in Oracle Payroll.

Detection Guidance

This vulnerability is specific to Oracle Payroll within Oracle E-Business Suite and requires logon access to the infrastructure. Detection would involve checking for unauthorized access or unusual activity in Oracle Payroll logs and configurations. Review Oracle's security advisories and apply patches if available.

Impact Analysis

If you use Oracle Payroll versions 12.2.3 to 12.2.15, an attacker with local access could gain unauthorized access to sensitive payroll data. This may result in data breaches, financial fraud, or compliance violations depending on the exposed information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face legal penalties, fines, or reputational damage if data is compromised.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, specifically addressing the Oracle Payroll component. Ensure all affected versions (12.2.3-12.2.15) are updated to the patched release. Restrict user privileges to minimize access to Oracle Payroll infrastructure.

Hi! I’m here to help you understand CVE-2026-60893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70