This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15 and is classified under CWE-284 (Improper Access Control). It permits a low-privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Time and Labor. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of sensitive information managed by Oracle Time and Labor. There is no impact on system availability reported.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply security patches promptly to address vulnerabilities. Although no explicit patch or remediation level is confirmed for CVE-2026-60951 in the advisory, it is strongly advised to monitor Oracle's Critical Patch Update documentation and apply any relevant patches for Oracle Time and Labor versions 12.2.3 through 12.2.15 as soon as they become available. Until patches are applied, restrict network access to Oracle Time and Labor interfaces where possible to limit exposure.