This vulnerability affects Oracle Labor Distribution within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the product by unauthorized modification of accessible data, including update, insert, or delete actions. The CVSS 3.1 base score is 3.1, reflecting a network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No vendor advisory explicitly states a patch or fix for this vulnerability yet, but it is listed in the July 2026 Oracle Critical Patch Update advisory, which includes many patches across Oracle products. The vendor strongly recommends applying available patches promptly to mitigate risks.

Successful exploitation allows unauthorized modification (update, insert, delete) of some data accessible through Oracle Labor Distribution. There is no impact on confidentiality or availability. The attack requires network access via HTTP and is difficult to exploit due to high attack complexity and low privileges. The overall impact is limited to data integrity.

The vendor advisory does not explicitly confirm a patch for this specific vulnerability but references the July 2026 Critical Patch Update, which includes multiple security patches. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Labor Distribution versions 12.2.3 through 12.2.15 without delay. Maintaining actively supported versions and timely patching is strongly recommended by Oracle. Patch status is not yet confirmed for this specific CVE; check the vendor advisory for current remediation guidance.