This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data, as well as causing a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this specific product and version. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, compromising data integrity. Additionally, it can cause a partial denial of service, impacting availability. Confidentiality is not affected. The vulnerability requires network access and low privileges, making it relatively easy to exploit.

Oracle has released a Critical Patch Update advisory in July 2026 covering numerous vulnerabilities across many products. However, the advisory does not explicitly confirm a patch for Oracle Time and Labor versions 12.2.3 through 12.2.15. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Time and Labor interfaces where possible to reduce exposure.