Oracle Time and Labor EUVD-2026-47531

Exploitation requires that a person other than the attacker - typically an authenticated Oracle EBS user with access to Time and Labor - interact with attacker-supplied content (e.g., click a crafted link, visit a page embedding the payload), fulfilling the UI:R condition. The attacker requires no credentials of their own (PR:N). The vulnerable component must be accessible over HTTP from the attacker's position (AV:N), though in most enterprise EBS deployments this is internal-network access rather than public internet. Exploitation is limited by the mandatory victim interaction requirement, meaning fully automated or worm-propagating exploitation is not applicable. The scope change condition means that impact beyond Time and Labor requires the victim's session to have access to co-resident EBS components. Non-default configurations or specific feature enablement are not identified as prerequisites in the available data.

The raw CVSS 3.1 score of 6.1 (Medium) reflects a combination of high accessibility (AV:N, AC:L, PR:N) offset by reduced impact (C:L, I:L, A:N) and the requirement for victim interaction (UI:R). Real-world risk is moderate: the attack is unauthenticated and low-complexity from a network position, but requires social engineering or a trusted context to elicit victim interaction - this raises the practical exploitation bar above fully automated attacks. The scope change is the most consequential signal: successful exploitation can propagate impact to other EBS modules sharing the same application context, meaning data integrity exposure may not be limited to Time and Labor alone. No EPSS score is provided in the source data; without it, base-rate exploitation probability cannot be quantified. No KEV listing and no public POC have been identified, which is consistent with a medium-priority patch-cycle item rather than an emergency response. Oracle EBS environments typically run behind corporate perimeters, reducing internet-facing exposure, but internal threat actors or phishing-delivered payloads remain realistic vectors. The 'Authentication Bypass' tag elevates concern slightly, suggesting a victim's authenticated privilege may be abused.

An attacker crafts a malicious HTTP link or embeds a payload in a page that, when accessed by an authenticated Oracle Time and Labor user, causes the victim's browser to execute attacker-controlled operations within the EBS application context. Because the scope change allows cross-component impact, the attacker may be able to read or manipulate data in EBS modules beyond Time and Labor using the victim's established session. No public proof-of-concept code has been identified; this scenario is inferred from the CVSS vector.