This vulnerability affects Oracle Time and Labor versions 12.2.3 to 12.2.15 and involves an attacker with low privileges and network access via HTTP being able to compromise the product to perform unauthorized creation, deletion, or modification of critical or accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Customers are urged to apply security patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Time and Labor. This impacts data integrity but does not affect confidentiality or availability. The vulnerability requires network access via HTTP and is considered difficult to exploit. No known active exploits have been reported.

Oracle's advisory strongly recommends applying Critical Patch Updates without delay to address this and other vulnerabilities. Although no explicit patch or remediation level is stated for this vulnerability, customers should verify the latest Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html and apply relevant patches for Oracle Time and Labor versions 12.2.3 through 12.2.15. Maintaining up-to-date software versions and applying vendor patches promptly is the primary mitigation.