Oracle Payroll Self Service Manager CVE-2026-46827: Brief Summary of a CVSS 8.8 Privilege Escalation to Full Takeover

Introduction

A low-privileged employee account on Oracle E-Business Suite is all it takes to take over Oracle Payroll, along with the salary data, bank account details, tax identifiers, and employee PII for the entire organization. CVE-2026-46827, disclosed in Oracle's May 2026 Critical Security Patch Update, is an authorization bypass in the Self Service Manager component of Oracle Payroll. It scores CVSS 8.8, with High impact on confidentiality, integrity, and availability.

Oracle EBS is deployed at approximately 21,656 organizations worldwide, and Oracle recently passed SAP as the number one ERP applications vendor. Every supported EBS 12.2 release, from 12.2.3 through 12.2.15, is affected. The vulnerability also arrives less than a year after the Cl0p ransomware group exploited a different Oracle EBS zero-day (CVE-2025-61882) in a large-scale extortion campaign. That campaign established a clear pattern of threat actor interest in this product line.

Technical information

Vulnerability scope and affected component

CVE-2026-46827 is in the Self Service Manager component of Oracle Payroll, which is part of the broader Oracle E-Business Suite HCM module. The Self Service Manager is a web-based HTTP interface where employees can view payslips, update direct deposit information, and manage tax withholding selections. Any authenticated EBS user who has been granted self-service access can reach it.

The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, which is the entire supported release range of EBS Release 12.2.

CVSS 3.1 vector analysis

The full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 8.8 (High). The components break down as follows:

CVSS Component	Value	Implication
Attack Vector (AV)	Network	Exploitable remotely over HTTP, without physical or local access
Attack Complexity (AC)	Low	No special conditions needed, so exploitation is straightforward
Privileges Required (PR)	Low	Attacker needs only a low-privileged authenticated account
User Interaction (UI)	None	No victim action needed to trigger the vulnerability
Scope (S)	Unchanged	Impact confined to the vulnerable Oracle Payroll component
Confidentiality (C)	High	Complete information disclosure possible
Integrity (I)	High	Complete modification of Payroll data possible
Availability (A)	High	Complete denial of service to Payroll possible

Low attack complexity and no user interaction mean that exploitation can be automated once an attacker has any valid low-privilege credential. With High impact on all three of confidentiality, integrity, and availability, a successful attack is functionally equivalent to a full application takeover within the Oracle Payroll subsystem.

Attack flow

Based on the CVSS vector, Oracle's advisory description, and the component's architecture, exploitation follows a privilege escalation pattern consistent with enterprise ERP authorization bypass vulnerabilities:

Initial Access: The attacker authenticates to Oracle E-Business Suite with a low-privileged account. This could be a standard employee self-service account, a credential stolen through phishing or credential stuffing, or an insider with minimal access.
Targeting the Self Service Manager: The attacker sends crafted HTTP requests to the Self Service Manager component. Every employee with a self-service role is meant to reach this component, so the attacker is already inside the expected access boundary.
Authorization Bypass: The Self Service Manager does not properly enforce authorization boundaries on certain operations. It processes the crafted requests with elevated privileges, which gives the attacker access beyond their intended scope.
Payroll Takeover: Oracle describes the result as "takeover of Oracle Payroll." That indicates the attacker can view, modify, or delete all payroll data and potentially disrupt payroll processing. The data at risk includes salary information, bank account details for direct deposits, tax identifiers (SSNs, TINs), and comprehensive employee PII.

According to the Oracle May 2026 CSPU risk matrix, CVE-2026-46827 is not remotely exploitable without authentication (the "Remote Exploit without Auth" column reads "No"). Three other CVEs in the same advisory do allow unauthenticated exploitation.

Multiple payroll CVEs

The same May 2026 CSPU addresses at least two payroll-related vulnerabilities:

CVE	Component	CVSS	Remote Without Auth
CVE-2026-46827	Oracle Payroll: Self Service Manager	8.8	No
CVE-2026-46826	Oracle Payroll: Internal Operations over HTTPS	8.8	Not confirmed
CVE-2026-46837	Oracle Flow Manufacturing: Security over SQL	8.8	Not confirmed

Two payroll CVEs with identical CVSS scores in the same patch cycle suggest a cluster of authorization enforcement weaknesses in the Oracle Payroll subsystem, and point to a broader architectural concern rather than a single coding error. The Self Service Manager and Internal Operations components may share common authorization architecture with multiple bypass points.

Information gaps

The NVD entry is marked "Awaiting Enrichment" as of May 29, 2026. NIST has not published a CVSS 4.0 score, a CWE classification, or expanded technical analysis. The exact type of authorization bypass has not been publicly documented. It could be an insecure direct object reference, missing function-level access control, or parameter tampering. No proof-of-concept code or detailed exploit write-up has been identified in public sources.

Affected systems and versions

The vulnerability affects the following:

Product: Oracle Payroll
Suite: Oracle E-Business Suite
Component: Self Service Manager
Affected Versions: 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14, and 12.2.15
Protocol: HTTP

This version range covers the entire supported release range of Oracle E-Business Suite Release 12.2. Any organization running EBS 12.2 with the Oracle Payroll module and Self Service Manager component enabled is potentially vulnerable.

The May 2026 CSPU contains 12 security patches for Oracle E-Business Suite in total, three of them for vulnerabilities that are remotely exploitable without authentication. Organizations should plan to apply the EBS patches as a bundle rather than patching CVE-2026-46827 in isolation.

Vendor security history

Oracle E-Business Suite's recent security record helps in judging the risk of CVE-2026-46827.

CVE-2025-61882 and the Cl0p precedent

The most significant prior event was CVE-2025-61882, a CVSS 9.8 critical vulnerability in the Concurrent Processing component through its BI Publisher Integration, affecting versions 12.2.3 through 12.2.14. The flaw allowed unauthenticated remote code execution over HTTP, and the Cl0p ransomware group exploited it in the wild in a large-scale extortion campaign.

CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities (KEV) Catalog and flagged it as used in ransomware campaigns. Google Cloud's Mandiant team confirmed that "a financially motivated actor conducting a large-scale extortion campaign under the CL0P brand" exploited the zero-day. Halcyon reported that Cl0p "likely used a newly-identified zero-day (CVE-2025-61882) and additional Oracle vulnerabilities to exploit internet-facing" Oracle EBS instances.

The Australian Cyber Security Centre (ACSC) and the Canadian Centre for Cyber Security both issued formal alerts urging immediate patching.

Patch volume and cadence

Oracle's Critical Patch Updates fix large numbers of vulnerabilities. The April 2026 CPU contained 481 new security patches across a wide range of products. The January 2026 CPU contained 8 new security patches for Oracle E-Business Suite alone, 2 of which were remotely exploitable without authentication.

Starting in May 2026, Oracle moved from its quarterly schedule to a monthly CSPU release cycle, so protection against new threats can ship faster. That is a significant structural improvement. Still, high-severity EBS vulnerabilities keep being found (CVSS 9.8 in October 2025, CVSS 8.8 in May 2026), which suggests ongoing problems in the legacy codebase, particularly with authorization enforcement in self-service components exposed over HTTP.

Threat intelligence context

As of May 29, 2026, no evidence of active exploitation of CVE-2026-46827 in the wild has been identified. The CVE is less than 48 hours old. No proof-of-concept exploits have been observed on GitHub, in exploit databases, or on cybercriminal forums.

No exploitation so far does not mean low risk. Several factors make exploitation more likely over time:

Low-privilege requirement: Any compromised employee account or stolen credential is enough to attempt exploitation, unlike CVE-2025-61882, which required no authentication at all.
HTTP-based attack vector: Attackers can exploit the flaw over the same web channels used for legitimate Self Service Manager access, which makes detection harder.
High-value target: Oracle Payroll holds salary data, bank account details, tax identifiers, and employee PII. That data is worth a lot on illicit markets and enables further attacks such as payroll diversion fraud.
Proven threat actor interest: Cl0p, and potentially other groups, have shown they are willing and able to exploit Oracle EBS vulnerabilities. Bitsight observed growing chatter about CVE-2025-61882 in cybercriminal forums even before a public proof of concept was released. That indicates threat actors watch Oracle vulnerability disclosures closely.

Organizations should assume that the window between public disclosure and active exploitation is narrowing. CVE-2025-61882 went from disclosure to a CISA KEV listing within days.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information