This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Time and Labor. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no required user interaction. Oracle's July 2026 Critical Patch Update advisory references multiple vulnerabilities but does not explicitly state the patch status for this specific CVE. The product is not a cloud service, so remediation depends on applying vendor patches.

The vulnerability enables unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor, potentially compromising the confidentiality and integrity of all accessible data in the product. There is no impact on availability. This could lead to significant data breaches or unauthorized data manipulation within affected Oracle Time and Labor environments.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-62504. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Since this is not a cloud service, remediation requires applying vendor patches. Until patches are applied, restrict network access to Oracle Time and Labor interfaces to trusted users only.