CVE-2026-70941

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle Payroll

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70941

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	payroll	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Payroll within Oracle E-Business Suite. It allows a low-privileged attacker with local access to compromise the Payroll component and potentially other related products. The attack could lead to a full takeover of Oracle Payroll.

Detection Guidance

Detection requires checking for Oracle Payroll versions 12.2.3 to 12.2.15 and verifying if unauthorized access or privilege escalation has occurred in the Oracle Payroll component. Review logs for suspicious activity in the Oracle Payroll execution environment.

Impact Analysis

An attacker could gain control over Oracle Payroll, leading to unauthorized access, data breaches, or disruption of payroll operations. This could affect sensitive employee data and financial processes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised due to data breaches or loss of confidentiality.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, specifically addressing the Oracle Payroll component. Ensure all affected versions (12.2.3-12.2.15) are updated to the patched release.

Hi! I’m here to help you understand CVE-2026-70941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70