Oracle Time and Labor CVE-2026-61013

Exploitation requires network-level HTTP access to an Oracle E-Business Suite application server running Oracle Time and Labor versions 12.2.3 through 12.2.15. The CVSS vector confirms PR:H - the attacker must hold high-privileged credentials within the Oracle EBS environment, meaning exploitation is limited to insiders, compromised privileged accounts, or post-initial-compromise lateral movement. High attack complexity (AC:H) introduces additional conditions beyond the attacker's direct control; the precise nature of these conditions (e.g., timing, race conditions, specific configuration state) is not disclosed in available data. No user interaction is required once exploitation conditions are met. The 'Authentication Bypass' tag may indicate that the flaw bypasses secondary authorization controls within the Internal Operations component rather than eliminating the initial authentication requirement - this ambiguity is unresolved from current data. The scope change condition means environments where Oracle EBS modules share infrastructure face broader potential impact beyond Time and Labor alone.

The CVSS 3.1 base score of 6.6 (Medium) understates headline severity but appropriately reflects meaningful exploitation barriers. The PR:H requirement means an attacker must already possess high-privileged Oracle EBS credentials, substantially limiting the realistic threat population to insiders, compromised admin accounts, or post-initial-access lateral movement scenarios. AC:H further constrains exploitation by requiring conditions beyond simple attacker control - the precise complexity condition is not detailed in available data but may involve race conditions, specific configuration states, or sequencing requirements. Counterbalancing these constraints, the C:H and S:C components represent serious potential impact: full exfiltration of all Time and Labor data (payroll hours, employee records) and cross-module cascading effects within EBS. The 'Authentication Bypass' tag from ENISA EUVD introduces an unresolved tension with PR:H - if the bypass is of secondary authorization rather than initial authentication, the PR:H floor still applies, but privilege escalation post-authentication could raise effective impact. EPSS data is not provided, and the vulnerability is absent from CISA KEV, meaning no confirmed active exploitation is documented. No public POC is identified at time of analysis. Net assessment: moderate real-world priority - elevated for organizations with EBS deployments where privileged account compromise is a realistic threat vector, especially in sensitive HR/payroll environments.

A malicious insider or an attacker who has compromised a high-privileged Oracle EBS account crafts a specialized HTTP request targeting the Oracle Time and Labor Internal Operations endpoint, satisfying the high-complexity exploitation conditions. Upon success, the attacker exfiltrates the complete Time and Labor dataset - potentially including employee hours, payroll inputs, and scheduling data - and makes limited unauthorized modifications; due to scope change, the attacker may also pivot to impact additional EBS modules sharing the same application context. No public POC is available at time of analysis.