Oracle Time and Labor CVE-2026-61012

Exploitation requires network HTTP access to the Oracle E-Business Suite middle tier hosting Oracle Time and Labor, plus a valid low-privileged EBS account (CVSS PR:L confirms authentication is required - this is NOT unauthenticated). The affected deployment must be EBS 12.2.3 through 12.2.15 with the Time and Labor product and its Internal Operations component in use. Limiting factors: an attacker needs at least a low-privilege application credential and reachability to the EBS HTTP endpoints, so exposure is bounded by how broadly EBS accounts are issued and whether the application tier is internet-facing versus internal-only; no special non-default configuration is called out in the description, and no user interaction is needed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) describes a remotely reachable, low-complexity attack requiring only low privileges and no user interaction - meaning any authenticated EBS user with network access could potentially exploit it, a realistic condition in multi-user ERP environments. The high integrity impact (I:H) is the dominant driver, allowing corruption or destruction of critical Time and Labor data, while availability impact is only partial (A:L) and confidentiality is unaffected (C:N). No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the 7.1 score is the only strong signal. This is a genuine priority for organizations running EBS 12.2 because the barrier (authenticated network access) is commonly met, but the absence of confirmed active exploitation or public POC suggests it is not currently an emergency-patch scenario. Note: PR:L indicates authentication IS required, so this is not an unauthenticated internet-wide risk despite AV:N.

An attacker who holds any low-privileged Oracle E-Business Suite account - for example a standard employee self-service login - sends crafted HTTP requests to the Time and Labor Internal Operations component to create, alter, or delete timekeeping and labor data beyond their authorization. Because attack complexity is low and no user interaction is needed, a single valid credential is sufficient to tamper with critical data or partially disrupt the module. No public proof-of-concept was identified at time of analysis.