Oracle Time and Labor CVE-2026-60951

The attacker must have a valid low-privilege Oracle E-Business Suite account (CVSS PR:L) and HTTP network access to the EBS web tier hosting the Oracle Time and Labor / Internal Operations component; the affected instance must run EBS 12.2.3 through 12.2.15. No user interaction and no admin/high privilege are required, making exploitation easy once any authenticated foothold exists. Limiting factors: exploitation is not unauthenticated (despite the 'Authentication Bypass' tag, the CVSS vector requires an existing account), it only affects data within Time and Labor's authorization scope (S:U, no availability impact), and instances whose EBS web tier is not network-reachable by the attacker are out of reach.

The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only a low-privilege account and no user interaction - a genuinely elevated risk for any internet- or intranet-exposed EBS deployment, since valid EBS accounts are common in large organizations and self-registration/portal access widens the low-privilege pool. Offsetting this, PR:L means it is NOT unauthenticated, there is no availability impact, and no EPSS score, POC, or KEV entry was provided, so there is no evidence of active or automated exploitation at this time. One conflict must be flagged: the input tag says 'Authentication Bypass', which implies unauthenticated access, but the CVSS vector explicitly requires PR:L (a privileged account) - verify with Oracle whether an unauthenticated path exists, because if so the real severity would be higher than 8.1. Net: a real patch-now priority for exposed EBS instances given ease of exploitation and high C/I impact, but not yet a confirmed in-the-wild threat.

An attacker who holds any low-privilege Oracle EBS account (for example an employee self-service login or a compromised low-tier credential) sends crafted HTTP requests to the Time and Labor / Internal Operations endpoints and, exploiting the authorization weakness, reads or alters payroll/labor records and other Time and Labor data belonging to other users. No user interaction or elevated privileges are needed, and because attack complexity is low the requests are straightforward to reproduce; no public POC has been identified at time of analysis.