This vulnerability affects Oracle Time and Labor versions 12.2.3 through 12.2.15 and allows unauthenticated network attackers to exploit it via HTTP. Exploitation requires user interaction from a person other than the attacker, and successful attacks can lead to unauthorized modification (update, insert, delete) and partial unauthorized reading of Oracle Time and Labor data. The vulnerability has a CVSS 3.1 score of 6.1 with network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and impacts on confidentiality and integrity but not availability. The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability. The advisory strongly recommends applying available patches promptly but does not provide direct patch information for this CVE.

An attacker with network access via HTTP can exploit this vulnerability without authentication but requires a user other than themselves to interact (social engineering or similar). Successful exploitation can lead to unauthorized changes (update, insert, delete) to some Oracle Time and Labor accessible data and unauthorized reading of some data subsets. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Time and Labor. The confidentiality and integrity of affected data are at risk, but availability is not impacted.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Until an official patch is confirmed and applied, organizations should consider minimizing exposure of Oracle Time and Labor HTTP interfaces to untrusted networks and educate users to be cautious of unexpected interactions that could trigger exploitation.