This vulnerability in Oracle Labor Distribution (component: Internal Operations) enables a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Labor Distribution. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Affected versions are 12.2.3 through 12.2.15 inclusive. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes patches for this and many other vulnerabilities.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Labor Distribution, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive business data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.3 through 12.2.15. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.