CVE-2026-62508

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle Time and Labor de Oracle E-Business Suite (componente: Operaciones Internas). Las versiones soportadas que están afectadas son 12.2.3-12.2.15. Vulnerabilidad difícil de explotar permite a un atacante con bajos privilegios con acceso de red vía HTTP comprometer Oracle Time and Labor. Ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegación de servicio parcial (DoS parcial) de Oracle Time and Labor. Puntuación Base CVSS 3.1 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

Information

Published : 2026-07-21 22:19

Updated : 2026-10-24 17:10

NVD link : CVE-2026-62508

Mitre link : CVE-2026-62508

CVE.ORG link : CVE-2026-62508

JSON object : View

Products Affected

oracle

time_and_labor

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-62508", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62508", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T15:23:20.370399Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Time and Labor", "versions": [{"status": "affected", "version": "12.2.3", "versionType": "custom", "lessThanOrEqual": "12.2.15"}]}]}], "published": "2026-07-21T22:19:06.380", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Time and Labor. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Time and Labor de Oracle E-Business Suite (componente: Operaciones Internas). Las versiones soportadas que est\u00e1n afectadas son 12.2.3-12.2.15. Vulnerabilidad dif\u00edcil de explotar permite a un atacante con bajos privilegios con acceso de red v\u00eda HTTP comprometer Oracle Time and Labor. Ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DoS parcial) de Oracle Time and Labor. Puntuaci\u00f3n Base CVSS 3.1 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3E87317-2FC0-4961-8006-0AECCE2DEC2D", "versionEndIncluding": "12.2.15", "versionStartIncluding": "12.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}