What is the CVSS score of CVE-2026-62504?

CVE-2026-62504 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Time and Labor are affected by CVE-2026-62504?

Oracle Time and Labor in E-Business Suite versions 12.2.3-12.2.15 contains a critical data compromise vulnerability allowing low-privileged attackers with network access to read, create, delete, or…

How to fix or mitigate CVE-2026-62504?

Within 24 hours, identify all Oracle E-Business Suite instances running Time and Labor versions 12.2.3-12.2.15 and immediately restrict HTTP network access using firewall rules or network segmentation, limiting Time and Labor connectivity to verified administrative systems only. Within 7 days, contact Oracle support to obtain patch availability timelines and status; implement enhanced transaction logging on all Time and Labor data access and modifications to detect unauthorized activity. Within 30 days, evaluate upgrade paths to post-12.2.15 patched versions and establish a migration plan with target completion date; maintain strict network-level access controls on affected versions until patching can be completed.

Oracle Time and Labor CVE-2026-62504

EUVD-2026-47530 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8c2x-3xq8-p22v

Authentication Bypass Oracle Time And Labor

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no interaction, but a valid low-privilege account is required (PR:L); broad data read/write gives C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:39 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Oracle Time and Labor is a workforce time-capture and labor-distribution module within the Oracle E-Business Suite (EBS) applications stack, exposed over HTTP as part of the EBS web tier. The affected component is 'Internal Operations.' No CWE was assigned by Oracle or NVD, but the third-party tag 'Authentication Bypass' combined with the CVSS profile (low-privilege attacker gaining broad read/write to all application-accessible data) is consistent with a broken-access-control or authorization-bypass class of flaw, where an already-authenticated low-privilege EBS user escalates their effective data access beyond their intended scope. The affected surface spans the entire 12.2.x release line (12.2.3-12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle ships these as EBS 12.2.x patch sets rather than a single named product version, so identify and apply the specific CPU patch for your 12.2.x level (no discrete fixed version number was provided in the input, so do not assume one beyond what the CPU lists). Until patched, restrict who holds low-privilege EBS accounts and audit their entitlements, place the EBS web tier behind a VPN or IP-allowlisted reverse proxy to limit HTTP reachability, and enable enhanced logging/monitoring on Time and Labor and Internal Operations transactions to detect anomalous data reads or writes; these controls reduce exposure but do not remove the underlying flaw and may add access friction for legitimate users. Because component-level patching is not always possible in isolation, plan to apply the full CPU rather than a partial workaround.