What is the CVSS score of CVE-2026-62505?

CVE-2026-62505 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Time and Labor CVE-2026-62505

EUVD-2026-47531 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q34q-vg8g-5w2c

Authentication Bypass Oracle Time And Labor

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network delivery via HTTP, unauthenticated, low complexity, but mandatory victim interaction; scope change with low C/I impacts and no availability impact matches client-side injection pattern.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Time and Labor, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Time and Labor accessible data as well as unauthorized read access to a subset of Oracle Time and Labor accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Time and Labor is the time-tracking and workforce-scheduling component of Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform. The Internal Operations sub-component handles backend processing logic accessible over HTTP. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C with C:L/I:L/A:N is the canonical fingerprint for client-side injection vulnerabilities such as Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) - the scope change (S:C) indicates that a successful attack affects a security context beyond the vulnerable component itself, consistent with browser-context hijacking or session-mediated data manipulation in co-resident EBS modules. The 'Authentication Bypass' tag suggests the attack leverages an authenticated victim's session context to perform unauthorized data operations without requiring attacker authentication. No CWE is assigned in the source data; the vulnerability class is inferred from the CVSS vector and description.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), available via My Oracle Support and the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU provides patches for all affected versions (12.2.3-12.2.15); an exact patched version number was not independently confirmed from the available data - consult the CPU advisory for the specific patch set identifier. As a compensating control where immediate patching is not feasible, restrict access to the Oracle Time and Labor application to trusted internal networks using network-layer controls (firewall ACLs, VPN enforcement), which reduces the attack surface by limiting who can deliver the triggering HTTP request to potential victims. Additionally, user awareness around clicking unsolicited links to EBS URLs reduces the likelihood of triggering the required user interaction. Neither control eliminates the vulnerability - patching is the only remediation.