This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15 and involves a difficult-to-exploit flaw that allows a high privileged attacker with network access via HTTP to compromise the product. The scope of impact extends beyond Oracle Time and Labor to additional Oracle products. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data accessible by Oracle Time and Labor. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) indicates network attack vector, high attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to remain on supported versions and apply patches promptly when available.

Successful exploitation allows a high privileged attacker with network access to gain unauthorized access to critical data within Oracle Time and Labor and potentially other Oracle products. The attacker can also perform unauthorized update, insert, or delete operations on some data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability’s scope change means it may affect additional Oracle products beyond Time and Labor.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory for this vulnerability.