CVE-2026-70941

HighCVSS 8.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

Vulnerability in Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A low-privileged attacker with local access can take over Oracle Payroll, and attacks may impact additional products (scope change).

Risk Assessment

Successful attack can lead to full takeover of Oracle Payroll, potentially compromising confidentiality, integrity, and availability of data and affecting other systems.

Recommendation

Apply patches provided by Oracle for versions 12.2.3-12.2.15. Restrict local access to the system and monitor for suspicious activity.

Original NVD description (English source)

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).