Oracle Time and Labor CVE-2026-62504

Exploitation requires network HTTP access to an Oracle E-Business Suite deployment running Oracle Time and Labor version 12.2.3 through 12.2.15 with the Internal Operations component reachable, and - per CVSS PR:L - a valid low-privileged EBS account. What limits exploitation: the attacker must already authenticate with some low-privilege credential (so it is not anonymous/pre-auth per the CVSS vector, despite the third-party 'Authentication Bypass' tag, which conflicts and should be confirmed with Oracle), the target must be an unpatched 12.2.x instance, and the HTTP web tier must be reachable from the attacker's position. No user interaction is required and attack complexity is low.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - Oracle explicitly calls it 'easily exploitable.' This is a genuine priority for organizations running EBS 12.2.x, because PR:L means any low-privilege EBS account (potentially a broad internal or partner user population) is a viable attacker. However, exploitation is NOT unauthenticated: the 'Authentication Bypass' tag conflicts with the CVSS PR:L rating - verify with Oracle whether a valid account is truly required, as this materially changes the exposure. No EPSS score, KEV listing, or POC was provided, so real-world exploitation likelihood cannot be quantified from the supplied data; the risk is driven by ease of exploitation and breadth of data impact rather than by confirmed active exploitation.

A low-privileged user with a valid Oracle EBS account (for example, an ordinary employee self-service or contractor login) sends crafted HTTP requests to the Time and Labor Internal Operations component and, exploiting the authorization weakness, reads or alters payroll/time data belonging to other users or the entire application dataset. Because attack complexity is low and no user interaction is needed, the action can be scripted; no public exploit code is currently identified, so an attacker would need to develop their own.