What is the CVSS score of CVE-2026-61013?

CVE-2026-61013 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Oracle Time and Labor CVE-2026-61013

EUVD-2026-47240 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-wgf6-p77x-5mvp

Authentication Bypass Privilege Escalation Oracle Time And Labor

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

6.6 MEDIUM

High privileges and network HTTP access required; high complexity reflects difficult exploitation conditions; scope change captures cross-module EBS impact; no availability impact described.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:34 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Time and Labor. While the vulnerability is in Oracle Time and Labor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data as well as unauthorized update, insert or delete access to some of Oracle Time and Labor accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle Time and Labor is a workforce management module within Oracle E-Business Suite (EBS) 12.2.x, responsible for employee time tracking, absence management, and scheduling. The affected component is labeled 'Internal Operations,' indicating back-end processing logic exposed via the EBS HTTP application tier. The CWE is not specified by NVD or the reporting source, which limits root cause classification; however, the 'Authentication Bypass' tag from ENISA EUVD (EUVD-2026-47240) suggests the flaw may involve improper authorization enforcement - such as a missing or bypassable access control check in internal API or service calls. The CVSS Scope Change (S:C) is significant: Oracle EBS modules share application server processes and database schemas, meaning exploitation of one module can directly affect others in the same EBS environment. The network vector (AV:N) via HTTP is consistent with Oracle EBS's standard web-based deployment model. No CPE strings were provided in available intelligence data.

RemediationAI

Oracle addressed this vulnerability as part of the July 2026 Critical Patch Update (CPU), published at https://www.oracle.com/security-alerts/cpujul2026.html. Organizations running Oracle E-Business Suite with Oracle Time and Labor in the affected version range (12.2.3-12.2.15) should apply the July 2026 CPU patches as the primary remediation. The exact patched component version number is not independently confirmed beyond the CPU advisory reference. As compensating controls prior to patching, administrators should audit and reduce the number of accounts holding high-privileged access to Oracle Time and Labor Internal Operations, enforce network-layer access controls restricting HTTP access to EBS application servers to only authorized subnets, and enable EBS audit logging on the Time and Labor Internal Operations component to detect anomalous high-privileged activity - noting that logging alone does not prevent exploitation but supports detection. Restricting privileged role grants within EBS reduces the attack surface given the PR:H requirement.