CVE-2026-61015

LowCVSS 3.7

Published: 21/07/2026(UTC)Updated: 03/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Vulnerability in Oracle Time and Labor (versions 12.2.3-12.2.15). Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.

Risk Assessment

An attacker can access time and labor data, compromising confidentiality and potentially enabling espionage or attack planning.

Recommendation

Apply the Oracle patch. Restrict network access to the Time and Labor system and implement HTTP traffic monitoring.

Original NVD description (English source)

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Time and Labor accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).