EUVD-2026-47524
GHSA-qqw3-4949-hhrr
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthorized data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (High) with high confidentiality and integrity impact but no availability impact, it was reported by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Time And Labor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Time and Labor (E-Business Suite versions 12.2.3-12.2.15) contains an authorization vulnerability allowing network-authenticated users with low-privilege accounts to access, modify, create, and delete all labor and payroll records without proper role-based restrictions. Organizations using this module face significant risks to payroll accuracy, compliance reporting, and financial data integrity.
Within 24 hours, conduct a full inventory of Oracle E-Business Suite Time and Labor installations running versions 12.2.3 through 12.2.15 and immediately restrict module access to authorized HR and payroll administrators only. Within 7 days, enable comprehensive audit logging on all labor record modifications, configure alerts for unauthorized access attempts, and review recent audit logs for evidence of unauthorized data access or changes. Within 30 days, contact Oracle support regarding patch availability and timing, perform a complete data integrity audit of payroll and labor records, and develop an upgrade plan for when a patched version becomes available.
Restrict Time and Labor module access to authorized HR and payroll personnel only; enable and monitor comprehensive audit logging of all record modifications; implement role-based access controls and periodic access reviews; conduct regular reconciliation of labor records against authoritative source systems; consider network-level isolation of the affected module pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Time And Labor
View allIn Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Moja
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 throu
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privile
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Rated high severity
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, networ
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a diff
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Intern
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the I
Exploit-DB