What is the CVSS score of CVE-2026-62503?

CVE-2026-62503 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Oracle Time and Labor CVE-2026-62503

EUVD-2026-47529 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-67pq-mf92-cf86

Authentication Bypass Denial Of Service Oracle Time And Labor

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

6.7 MEDIUM

Network HTTP attack requires high-privilege credentials (PR:H); easily exploitable (AC:L); full data confidentiality and integrity compromise with only partial availability impact (A:L).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:10 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.

Technical ContextAI

Oracle Time and Labor is a workforce management module within Oracle E-Business Suite, handling labor tracking, scheduling, and payroll interfaces through the 'Internal Operations' sub-component accessed over HTTP. Affected versions span 12.2.3 through 12.2.15 of the 12.2 release train. The CWE is listed as N/A by NVD, leaving the root cause class uncharacterized; however, the 'Authentication Bypass' tag from ENISA EUVD (EUVD-2026-47529) suggests a possible access-control enforcement failure or authorization logic flaw within the Internal Operations component, rather than a pure authentication bypass at the session layer. Oracle describes the vulnerability as 'easily exploitable,' indicating low attack complexity once network access and high-privilege credentials are obtained. The attack surface is the HTTP interface, consistent with Oracle E-Business Suite's browser-based architecture.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-62503 in Oracle Time and Labor. Oracle does not publish granular patch version identifiers separately from the CPU bundle; organizations should follow Oracle's patch application guidance for EBS 12.2.x. As a compensating control prior to patching, restrict HTTP access to Oracle EBS Internal Operations endpoints to trusted networks and enforce IP allowlisting at the network perimeter. Audit and minimize the number of accounts holding high-privilege roles within the Time and Labor module, as exploitation requires PR:H credentials; reducing the attack surface of privileged accounts directly limits exploitability. Monitor application logs for anomalous data access or modification patterns within the Time and Labor module. Note that network-layer restrictions alone will not protect against insider threats or already-compromised privileged accounts.