This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15. It is exploitable remotely without authentication but is considered difficult to exploit due to the high attack complexity. Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Time and Labor. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects network attack vector, high complexity, no privileges or user interaction required, and limited confidentiality impact only. No official remediation level or patch information is explicitly stated in the vendor advisory, but the vulnerability is included in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products.

The impact is unauthorized disclosure of some Oracle Time and Labor data. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the risk. No known exploits in the wild have been reported.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Since no explicit patch or workaround details are provided in the advisory excerpt, users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for specific patch availability and installation instructions. No alternative mitigations or 'no action required' statements are provided.