This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to apply patches promptly and remain on supported versions.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, unauthorized access to all accessible data, and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The CVSS score of 6.7 reflects a medium severity with significant confidentiality and integrity impact and limited availability impact.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific patch or temporary fix for this vulnerability is explicitly stated in the advisory content provided.