This vulnerability affects Oracle Time and Labor within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Time and Labor. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the specific patch availability for this vulnerability is not detailed in the advisory excerpt provided.

The vulnerability allows unauthorized access to critical data within Oracle Time and Labor, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the data but does not impact system availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively easy if the vulnerability is unpatched.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities, including this one. However, the provided advisory content does not explicitly confirm the availability of a patch for Oracle Time and Labor versions 12.2.3 to 12.2.15. It is strongly recommended to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until confirmed patched, organizations should consider restricting network access to Oracle Time and Labor interfaces and monitor for unusual activity.