This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15 and enables a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized modification of critical data and partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and recommends applying patches promptly. However, the vendor advisory does not explicitly confirm the availability of a specific patch for this vulnerability in the provided content.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, impacting data integrity. It also enables attackers to cause a partial denial of service, affecting availability. There is no confidentiality impact reported. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Time and Labor interfaces and monitor for suspicious activity related to unauthorized data modifications or service disruptions.