What is the CVSS score of CVE-2026-61012?

CVE-2026-61012 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle Time and Labor are affected by CVE-2026-61012?

Oracle Time and Labor in E-Business Suite 12.2.3-12.2.15 contains a high-severity integrity vulnerability allowing low-privileged authenticated users to tamper with labor records and partially…

How to fix or mitigate CVE-2026-61012?

Within 24 hours: identify and inventory all Oracle E-Business Suite instances running Time and Labor module versions 12.2.3-12.2.15, document user accounts with data modification access, and enable comprehensive audit logging on labor record transactions. Within 7 days: implement strict role-based access controls limiting labor data write permissions to essential payroll administrators only, enforce database audit trails with 90-day minimum retention for all modifications, and apply firewall segmentation to restrict network access to the Time and Labor Internal Operations component to trusted source IP ranges only. Within 30 days: subscribe to Oracle Critical Patch Updates, establish a testing protocol for immediate patch staging in non-production environments upon release, conduct a full integrity audit of all labor records accessed or modified during the vulnerability window, and maintain readiness for emergency patching upon vendor availability.

Oracle Time and Labor CVE-2026-61012

EUVD-2026-47239 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mxcg-m28j-g74x

Authentication Bypass Denial Of Service Oracle Time And Labor

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network HTTP reach with low complexity and a required low-privilege EBS account (PR:L); high integrity impact on data with only partial availability loss and no confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

AnalysisAI

Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Oracle Time and Labor is a workforce timekeeping and labor-distribution module within Oracle E-Business Suite (EBS), a large integrated ERP/HCM stack typically deployed as internet- or intranet-facing web application servers fronting an Oracle database. The vulnerable 'Internal Operations' component is reached over HTTP, consistent with EBS's Oracle Application Server / WebLogic-based middle tier. No CWE was assigned in the input, so the precise root-cause class (e.g., improper authorization or input validation) cannot be stated with certainty; the CVSS profile (C:N, I:H, A:L) points to a flaw that grants unauthorized write/modify capability on application data rather than information disclosure or memory corruption. The affected release train is the EBS 12.2 line (12.2.3 through 12.2.15), the current supported EBS 12.2 codeline.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle ships EBS security fixes as consolidated CPU patches rather than as an individual point-release, so the exact patched build corresponds to the July 2026 CPU level for EBS 12.2; no standalone fix version string was provided in the input, so verify the precise patch number against the CPU advisory for your 12.2.x level. As compensating controls until patched, restrict network access to the EBS middle tier and the Time and Labor / Internal Operations functions to trusted internal segments (the attack requires HTTP reachability), tighten application-level responsibility/role assignments so fewer authenticated users hold Time and Labor access (PR:L means any low-privileged account is a potential vector), and increase auditing/monitoring of Time and Labor data changes to detect unauthorized modification given the high integrity impact - the trade-off being added administrative overhead and potential disruption to legitimate self-service timekeeping users.