This vulnerability in Oracle Time and Labor (versions 12.2.3 to 12.2.15) enables a low privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay to mitigate such vulnerabilities.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or all data accessible within Oracle Time and Labor, compromising confidentiality and integrity. This could lead to significant data manipulation or data breaches within affected Oracle Time and Labor environments. Availability is not impacted according to the CVSS vector.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly. Although no explicit patch or remediation level is stated for this vulnerability, customers should apply the latest Critical Patch Updates from Oracle to mitigate this issue. There is no indication that no action is required or that the vulnerability is already mitigated. Monitor Oracle's advisory for updates on patch availability specific to Oracle Time and Labor versions 12.2.3 through 12.2.15.