CVE-2026-60951 in Time and Labor
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Time and Labor component of the Oracle E-Business Suite, specifically within the Internal Operations functionality. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product lifecycle where this security weakness has persisted. The vulnerability's classification as easily exploitable indicates that attackers with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP, making it particularly dangerous as it can be exploited from remote locations without requiring physical presence or complex initial access methods.
The technical flaw manifests as a privilege escalation issue within the application's authorization mechanisms, allowing low-privileged users to gain elevated access rights to critical system resources. This weakness enables attackers to perform unauthorized operations including data creation, deletion, and modification across all Oracle Time and Labor accessible data. The vulnerability's impact extends beyond simple data corruption to include complete unauthorized access to critical information, potentially exposing sensitive employee time tracking data, payroll information, and related operational records that organizations consider highly confidential.
From an operational perspective, the CVSS 3.1 base score of 8.1 indicates a high-severity threat with significant confidentiality and integrity impacts. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reveals that the attack requires network access with low complexity but only low privilege levels, with no user interaction required and an unscoped impact on the system. This configuration means that attackers can potentially compromise entire organizational time and labor databases without requiring extensive reconnaissance or specialized tools. The vulnerability's presence in multiple versions suggests it was either poorly addressed during patch cycles or represents a fundamental architectural weakness that persisted across the product's evolution.
Organizations should immediately implement mitigation strategies including applying the latest Oracle patches and security updates, implementing network segmentation to limit access to the vulnerable application, and conducting thorough privilege reviews to minimize the attack surface. The vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques involving privilege escalation and credential access. Additionally, organizations should consider implementing web application firewalls and monitoring for unusual access patterns in time and labor systems, as this vulnerability could enable attackers to manipulate workforce data that may affect financial reporting, compliance requirements, and operational efficiency across enterprise environments.