What is the CVSS score of CVE-2026-60951?

CVE-2026-60951 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Time and Labor are affected by CVE-2026-60951?

Oracle Time and Labor module in E-Business Suite versions 12.2.3-12.2.15 contains a data access vulnerability allowing low-privilege users to read, create, delete, or modify time and labor records.

How to fix or mitigate CVE-2026-60951?

Within 24 hours: identify all systems running affected Time and Labor versions 12.2.3-12.2.15 and audit access logs for suspicious data modifications. Within 7 days: implement network segmentation to restrict low-privilege account HTTP access to the Time and Labor module, and prepare for Oracle July 2026 Critical Patch Update deployment. Within 30 days: deploy the Oracle CPU patch immediately upon availability, conduct comprehensive audit of time and labor data for unauthorized changes, and review all low-privilege account access policies.

Oracle Time and Labor CVE-2026-60951

EUVD-2026-47209 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xxgf-x7hj-4pf8

Authentication Bypass Oracle Time And Labor

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a required low-privilege account (PR:L) and no interaction; high confidentiality and integrity impact but no availability effect and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Time and Labor is the time-and-attendance / labor-costing module within Oracle E-Business Suite (EBS), the on-premises Oracle ERP/HCM stack, here in the Internal Operations component. EBS is a web-tier application typically fronted by Oracle HTTP Server and Oracle Application Server, which is why the vector is AV:N over HTTP. No CWE was assigned by the reporter (Oracle rarely publishes CWE in CPU advisories), so the precise root-cause class is unstated; the vendor tag 'Authentication Bypass' plus the high confidentiality and integrity impact is most consistent with a broken access-control / authorization flaw that lets an authenticated but low-privilege user reach data or operations beyond their assigned role. The scope is Unchanged (S:U), meaning impact stays within the Time and Labor authorization context rather than pivoting to the host OS or other EBS modules.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch covering EBS 12.2.3-12.2.15; Oracle strongly recommends applying CPU patches without delay and no standalone fix version outside the CPU is published. Because the input provides no separate workaround, compensating controls if patching must be deferred are: restrict network reachability of the EBS web tier and specifically the Time and Labor / Internal Operations URLs to trusted internal networks or VPN (trade-off: breaks legitimate remote/self-service access), tighten role assignments and disable or audit low-privilege and self-registered accounts to shrink the pool of accounts that can reach the flaw (trade-off: operational overhead reviewing responsibilities), and increase monitoring of EBS access logs for anomalous data reads/modifications in Time and Labor. These controls reduce exposure but do not remove the vulnerability, so patching remains required.