CVE-2026-61216 in Payroll
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Payroll accessible data as well as unauthorized read access to a subset of Oracle Payroll accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Payroll. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Payroll component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that enables low-privileged attackers to compromise the payroll system through network-based HTTP connections, demonstrating a critical gap in access control mechanisms. The vulnerability's exploitability score of 7.5 out of 10 indicates that an attacker with minimal privileges and network access can successfully exploit this weakness without requiring special circumstances or advanced skills.
The technical nature of this vulnerability stems from inadequate input validation and insufficient authorization checks within the payroll processing component, allowing malicious actors to manipulate HTTP requests and gain unauthorized access to sensitive payroll data. The CVSS 3.1 score of 6.3 reflects the moderate severity impact across confidentiality, integrity, and availability vectors, where attackers can potentially modify payroll records, insert fraudulent entries, delete legitimate data, or read restricted payroll information. This weakness creates a pathway for data corruption and unauthorized disclosure that directly impacts financial accuracy and employee privacy.
From an operational perspective, successful exploitation of this vulnerability can lead to substantial business disruption including partial denial of service conditions that affect payroll processing capabilities. The unauthorized update, insert, or delete access capabilities pose direct threats to payroll integrity, potentially allowing attackers to manipulate employee compensation records, alter tax withholdings, or modify benefit calculations. Additionally, the unauthorized read access to subset of payroll data creates privacy risks and potential data leakage scenarios that could expose sensitive personal and financial information of employees.
The vulnerability's classification aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing), as attackers can leverage network access to escalate privileges within the payroll system. Organizations should implement immediate mitigations including applying Oracle's latest security patches, implementing network segmentation to restrict access to payroll systems, and deploying web application firewalls to monitor and filter HTTP traffic. Additional protective measures encompass strengthening authentication controls, enabling detailed audit logging for payroll transactions, and conducting regular vulnerability assessments to identify similar weaknesses in the broader Oracle E-Business Suite environment.
The impact extends beyond immediate data compromise as payroll systems typically contain highly sensitive information including social security numbers, income details, and tax information that makes them attractive targets for financial fraud. This vulnerability represents a significant risk to regulatory compliance with standards such as SOX, GDPR, and HIPAA, where unauthorized access to payroll data could result in substantial fines and legal consequences. Organizations must also consider the cascading effects of payroll manipulation on other integrated business systems including human resources, finance, and tax reporting applications that depend on accurate payroll data integrity.