This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) that enables a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Time and Labor. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability, so patch status remains unconfirmed.

The vulnerability allows unauthorized access to critical data within Oracle Time and Labor, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities across its product portfolio. However, the vendor advisory does not explicitly confirm the availability of a patch for CVE-2026-62504. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant patches promptly and remaining on actively supported versions to mitigate exploitation risks.