CVE-2026-46828
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) allows a low-privileged attacker with network access via HTTP to compromise data confidentiality and integrity. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all Oracle Payroll data.
Risk Assessment
The risk for the organization includes potential loss of confidentiality and integrity of payroll data, which may lead to personal data protection violations and financial or reputational damage.
Recommendation
It is recommended to immediately apply patches provided by Oracle for versions 12.2.3-12.2.15 and restrict network access to the Oracle Payroll system to trusted users only.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-62549Critical
Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.
- CVE-2026-46817CriticalActively exploited
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
- CVE-2026-70948High
Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing takeover. CVSS 8.8.
- CVE-2026-70947High
Vulnerability in Oracle Purchasing (component: Other issue). Affects versions 12.2.3-12.2.15. Easily exploitable by unauthenticated attacker via HTTP, allowing unauthorized access to critical data. CVSS 7.5.
- CVE-2026-70945High
Vulnerability in Oracle Payroll (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP, allowing unauthorized access to critical data. Scope change. CVSS 7.7.
- CVE-2026-62563Medium
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5-12.2.15 have a vulnerability in the Internal Operations component. A low-privileged authenticated attacker with network access via HTTP can exploit it, requiring human interaction, leading to unauthorized read and write access to some data and affecting other products.
- CVE-2026-62562Medium
Vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks can result in unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 6.5 (Confidentiality).
- CVE-2026-62561High
A vulnerability in Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A low privileged attacker with local access can easily exploit this vulnerability to compromise Oracle HRMS (US). Successful attacks can result in takeover of Oracle HRMS (US) (CVSS 7.8).
- CVE-2026-62560High
Vulnerability in Oracle HRMS (Norway) product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle HRMS (Norway) data. Attacks may significantly impact additional products (scope change).
- CVE-2026-62559Medium
A vulnerability in Oracle HRMS (US) of Oracle E-Business Suite allows a high-privileged attacker to access critical data. The vulnerability has a scope change, affecting other products.
Original NVD description (English source)
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data as well as unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).