What is the CVSS score of CVE-2026-62508?

CVE-2026-62508 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Oracle Time and Labor CVE-2026-62508

EUVD-2026-47533 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-xxgp-pfpw-q668

Denial Of Service Oracle Time And Labor

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.1 LOW

Network delivery via HTTP with high complexity and required low-privileged authentication; partial availability-only impact with no confidentiality or integrity effect aligns with the partial DOS description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service affecting Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by a low-privileged network attacker over HTTP under high-complexity conditions. Successful exploitation degrades availability of the Internal Operations component only, with zero confidentiality or integrity impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, placing it at the low end of operational priority.

Technical ContextAI

Oracle Time and Labor is a workforce management module within Oracle E-Business Suite, handling employee time tracking, labor scheduling, and timecard processing. The affected component is 'Internal Operations,' an internal processing layer exposed over HTTP. The CVSS vector (AV:N/AC:H/PR:L) indicates the vulnerability is network-reachable but requires elevated attack complexity - suggesting a race condition, specific application state dependency, or a non-trivially repeatable trigger mechanism. No CWE identifier has been assigned by NVD, meaning the precise root cause class (e.g., resource exhaustion, improper input validation, logic flaw) is not publicly documented. Scope is Unchanged (S:U), confirming the impact is contained within the Oracle Time and Labor component itself and does not propagate to other system components.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, which addresses this vulnerability. The advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number within the 12.2.x line is not independently confirmed from available references beyond the CPU advisory URL - consult Oracle My Oracle Support for the precise patch identifier. If immediate patching is not feasible, consider restricting HTTP access to Oracle E-Business Suite Internal Operations endpoints to a defined set of trusted network segments and authorized low-privileged accounts, reducing the attacker's network reachability. Note that restricting access may affect legitimate timecard submission workflows and should be tested against business operations before enforcement.