This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of accessible data. It can be exploited remotely without authentication over HTTP but is considered difficult to exploit due to the high attack complexity. The CVSS vector indicates no privileges required, no user interaction, and only a low confidentiality impact. No official patch or remediation level is stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying available patches promptly. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized disclosure of some Oracle Time and Labor data. There is no impact on data integrity or availability. The confidentiality impact is limited, and the vulnerability requires network access with high attack complexity, reducing the likelihood of exploitation.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches promptly. Although no specific patch for this vulnerability is explicitly detailed, Oracle advises customers to remain on actively supported versions and apply all available security patches without delay. Patch status is not yet confirmed for this specific vulnerability—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.