What is the CVSS score of CVE-2026-62507?

CVE-2026-62507 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Time and Labor CVE-2026-62507

EUVD-2026-47532 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-ff96-32vg-gqgr

Authentication Bypass Oracle Time And Labor

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible via HTTP but high-complexity conditions required; low-privileged account needed; only integrity impacted with no confidentiality or availability consequences.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.

Technical ContextAI

Oracle Time and Labor is a workforce management module within Oracle E-Business Suite (EBS), responsible for employee time tracking, scheduling, and labor cost allocation. The affected component, Internal Operations, handles backend processing logic within the application tier. The 'Authentication Bypass' tag suggests the root cause involves insufficient or improperly enforced authorization checks within internal service calls or API boundaries - a pattern common in EBS where internal component trust assumptions can be abused by authenticated users. No CWE is formally assigned, but the behavior is consistent with CWE-863 (Incorrect Authorization) or CWE-306 (Missing Authentication for Critical Function). Affected CPE corresponds to Oracle E-Business Suite 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently specified in the available data beyond the advisory reference; consult My Oracle Support for the applicable patch ID for your EBS release within the 12.2.3-12.2.15 range. As a compensating control pending patch application, restrict HTTP access to the Time and Labor Internal Operations component at the network or application firewall layer, limiting access to only those IP ranges hosting legitimate EBS middle-tier nodes. Additionally, review and tighten role-based access controls within EBS to ensure least-privilege assignment for Time and Labor module users, which reduces the pool of accounts capable of triggering the AC:H exploitation condition. Audit Internal Operations access logs for anomalous data modification patterns as a detection measure.