This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Time and Labor. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying available patches from their Critical Patch Updates to mitigate such vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive business data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. Although no explicit patch or remediation level is stated for CVE-2026-62494, customers should review the July 2026 Critical Patch Update documentation and apply relevant patches for Oracle Time and Labor versions 12.2.3 through 12.2.15. Maintaining up-to-date software and promptly applying Oracle's security patches is the primary mitigation. Patch status is not yet confirmed explicitly for this vulnerability; check the vendor advisory for current remediation guidance.