What is the CVSS score of CVE-2026-61015?

CVE-2026-61015 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Time and Labor CVE-2026-61015

EUVD-2026-47242 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-9vx7-29jh-97m3

Information Disclosure Oracle Time And Labor

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network HTTP access with no auth required, but high complexity limits reliable exploitation; only partial confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:33 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Time and Labor accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Oracle Time and Labor is a workforce management module within Oracle E-Business Suite (EBS), used for tracking employee work hours, scheduling, and labor compliance across enterprise deployments. The affected component is 'Internal Operations,' which handles backend processing and data access within the module. The 'Authentication Bypass' tag indicates the root cause likely involves a failure in the authentication or session validation logic governing access to internal HTTP endpoints. No CWE has been formally assigned by NVD, which limits precise root-cause classification. The vulnerability is reachable over HTTP (not requiring HTTPS or a VPN path by CVSS definition), targeting EBS versions 12.2.3 through 12.2.15 - a span of twelve release branches. The absence of a CWE and the AC:H rating together suggest the bypass may require specific request construction, timing, or state conditions rather than a straightforward unauthenticated GET/POST.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number within the CPU is not independently confirmed from the available data - consult the Oracle CPU documentation for your specific EBS release branch (12.2.3-12.2.15) to identify the correct patch bundle. As an interim compensating control while patching is scheduled, restrict network-level access to Oracle EBS HTTP endpoints using firewall rules or load-balancer ACLs to prevent unauthenticated external or untrusted network access - this directly counters the AV:N attack vector and is the most impactful near-term mitigation. Ensure Oracle EBS is not exposed to the public internet, as that would be a configuration violation of Oracle's supported deployment topology. Monitor HTTP access logs for anomalous unauthenticated requests to Internal Operations endpoints as a detection measure.