# CVE-2026-61250: Oracle E-Business Suite information disclosure in Oracle Payroll

Source: https://junglewise.ai/threats/cve-2026-61250-oracle-e-business-suite-information-disclosure-in-oracle-payroll  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-61250 · Severity: medium · CVSS 6.5 · Published 2026-07-21

A vulnerability exists in the Oracle Payroll component of the Oracle E-Business Suite, which is used by organizations to manage employee compensation and tax reporting. An attacker with basic user credentials could exploit this flaw over the network to gain unauthorized access to sensitive payroll information. This could lead to the exposure of confidential employee data, including salary details and personal identifiers, potentially resulting in privacy breaches and regulatory non-compliance.

Technologies: [Oracle Payroll](https://junglewise.ai/threats/technologies/payroll). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-61250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61250 being exploited in the wild.

**How severe is CVE-2026-61250?** Medium severity, with a CVSS score of 6.5, published 21 July 2026.

**Which products and versions are affected?** Oracle Payroll 12.2.3-12.2.15.

**Is there a fix for CVE-2026-61250?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-61250 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61250?** Check whether you run Oracle Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability affects the Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is classified as an information disclosure vulnerability that is easily exploitable by a low-privileged attacker with network access via HTTP. The exploit does not require user interaction and has a high impact on confidentiality, potentially allowing an attacker to access all data within the Oracle Payroll module. The vulnerability was addressed in the Oracle Critical Patch Update for July 2026. While the specific CWE is not provided in the advisory, the attack vector and impact suggest improper access control or an insecure direct object reference within the web interface.

## Affected products

- Oracle Corporation Payroll 12.2.3-12.2.15

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory: Oracle Critical Patch Update (CPU) published

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle E-Business Suite Payroll unauthorized data access](https://junglewise.ai/threats/cve-2026-70945-oracle-e-business-suite-payroll-unauthorized-data-access)
- [Oracle E-Business Suite Payroll privilege escalation](https://junglewise.ai/threats/cve-2026-70941-oracle-e-business-suite-payroll-privilege-escalation)
- [Oracle E-Business Suite compromise in Oracle Payroll Internal Operations](https://junglewise.ai/threats/cve-2026-62464-oracle-e-business-suite-compromise-in-oracle-payroll-internal)
- [Oracle Payroll unauthorized data access and partial DoS](https://junglewise.ai/threats/cve-2026-61216-oracle-payroll-unauthorized-data-access-and-partial-dos)
- [Oracle Payroll information disclosure in Internal Operations](https://junglewise.ai/threats/cve-2026-61142-oracle-payroll-information-disclosure-in-internal-operations)