CVE-2026-70945: Oracle Payroll Authentication Bypass Vulnerability

CVE-2026-70945 is an authentication bypass flaw in Oracle E-Business Suite Payroll affecting versions 12.2.3-12.2.15, allowing low-privileged attackers to gain unauthorized access to critical payroll data. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-70945 Overview

Oracle disclosed CVE-2026-70945, an access control vulnerability in the Oracle Payroll product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue to gain unauthorized access to sensitive Payroll data. The vulnerability introduces a scope change, meaning exploitation may impact resources beyond Oracle Payroll itself. The weakness is categorized under CWE-284 (Improper Access Control).

Critical Impact
Authenticated network attackers can achieve unauthorized read access to all Oracle Payroll accessible data, with cross-product impact due to scope change.

Affected Products

Oracle E-Business Suite - Oracle Payroll version 12.2.3
Oracle E-Business Suite - Oracle Payroll versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Payroll version 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70945 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70945

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle Payroll within Oracle E-Business Suite. An authenticated attacker holding minimal privileges can send crafted HTTP requests to reach Payroll functionality that should be gated behind stronger authorization checks. Successful exploitation grants read access to critical Payroll data, including records the attacker is not authorized to view.

The scope change property indicates the vulnerable component and the impacted component differ. Exploitation of the flaw in Oracle Payroll can therefore affect adjacent Oracle E-Business Suite modules that share data or trust boundaries with Payroll. This expands the practical blast radius beyond the immediate product.

The EPSS probability is 0.248%, reflecting current expectations of exploitation activity in the wild. No public proof-of-concept code or exploit is currently listed for this CVE.

Root Cause

The root cause is improper access control ([CWE-284]) within the Internal Operations component. The affected code path fails to enforce authorization checks appropriate to the sensitivity of the Payroll records it exposes. Low-privileged sessions can therefore reach data intended only for higher-privileged Payroll roles.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. No user interaction is required. The attacker issues HTTP requests to the vulnerable Payroll endpoints, bypassing intended authorization boundaries to retrieve confidential Payroll data. Integrity and availability of Payroll data are not impacted by this specific flaw.

No verified public exploit code exists for CVE-2026-70945. Refer to the Oracle Security Alert for vendor-provided technical detail.

Detection Methods for CVE-2026-70945

Indicators of Compromise

Unusual HTTP requests from low-privileged Oracle E-Business Suite user accounts targeting Payroll Internal Operations URLs.
Anomalous volumes of Payroll record reads by accounts that do not normally interact with Payroll data.
Session activity from Payroll-adjacent modules retrieving data outside the user's assigned responsibility set.

Detection Strategies

Review Oracle E-Business Suite application logs for HTTP access to Payroll Internal Operations endpoints by unexpected user roles.
Correlate database audit records with application session identity to detect authorization mismatches on Payroll tables.
Baseline normal Payroll data access patterns and alert on deviations by user, role, and object accessed.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for Payroll responsibilities.
Forward E-Business Suite application, web tier, and database audit logs to a centralized analytics platform for retention and cross-source correlation.
Monitor outbound traffic from the E-Business Suite tier for unexpected data egress following authenticated Payroll access.

How to Mitigate CVE-2026-70945

Immediate Actions Required

Apply the fix documented in the Oracle Security Alert for the August 2026 Critical Patch Update Security Alert covering Oracle Payroll versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite instances and confirm Oracle Payroll patch levels against the vendor advisory.
Review and reduce membership of Payroll-related responsibilities to enforce least privilege while the patch is deployed.

Patch Information

Oracle addressed CVE-2026-70945 as part of its security alert cycle. The authoritative patch reference is the Oracle Security Alert. Administrators should apply the corresponding E-Business Suite patch set for Oracle Payroll 12.2.3 through 12.2.15 after validating in a non-production environment.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted internal networks can reach Payroll endpoints.
Audit and remove unnecessary low-privileged accounts that hold any Payroll or Internal Operations responsibility.
Increase logging verbosity on Payroll transactions until the patch is applied and verified.

bash

# Configuration example
# Refer to the Oracle Security Alert for the authoritative patch instructions:
# https://www.oracle.com/security-alerts/cspuaug2026.html