CVE-2026-46828: Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unauthorized-access vulnerability affects the Internal Operations component of Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is reachable over HTTP from any network and requires only a low-privilege account, with no interaction from other users needed. Successful exploitation gives an attacker full read access to all Oracle Payroll data as well as the ability to create, modify, or delete that data. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Payroll service over the network via HTTP; the vulnerability is exposed on any network-accessible instance.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated credentials are needed beyond basic authenticated access.

• Victim interactionNot required

  No action from another user or administrator is needed to complete the attack.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race wins, or environmental setup.

Blast Radius

• An attacker reads all data accessible to Oracle Payroll, including employee compensation records, payroll runs, tax details, and banking information.
• An attacker creates, modifies, or deletes payroll records, potentially corrupting pay cycles or injecting fraudulent payment entries.
• Sensitive HR and financial data exposed through Oracle Payroll is fully readable without any additional privilege escalation steps.
• Integrity loss extends to all Oracle Payroll-accessible data, meaning audit trails and compliance records can be altered or destroyed.