Vulnerability record · CVE-2026-62494 · published 21 July 2026

CVE-2026-62494: Oracle time and labor improper access control vulnerability

Oracle · Time And Labor

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data as well as unauthorized access to critical data or complete access to all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

8.1 CVSS 3.1 High EPSS 0.36% · top 72.6% CWE-284 · Improper access control

8.1CVSS 3.1 base score

0.36%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

28 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Time And Labor Oracle

References

Link	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Track CVE-2026-62494 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2026-62504Oracle time and labor improper access control vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected …EPSS 0.36%21 Jul 2026 8.1CVE-2026-60951Oracle time and labor incorrect authorization vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected …EPSS 0.36%21 Jul 2026 8.1CVE-2021-2415Oracle time and labor vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Supported versions that are affected are 12.1.1-…EPSS 1.5%21 Jul 2021 8.1CVE-2021-2239Oracle time and labor vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Timecard). Supported versions that are affected are 12.1.1-…EPSS 0.93%22 Apr 2021 7.3CVE-2019-10086Apache commons beanutils deserialization of untrusted data vulnerabilityIn Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the clas…EPSS 28%20 Aug 2019 7.1CVE-2026-61012Oracle time and labor incorrect authorization vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected …EPSS 0.34%21 Jul 2026 6.7CVE-2026-62503Oracle time and labor improper access control vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected …EPSS 0.43%21 Jul 2026 6.6CVE-2026-61013Oracle time and labor improper privilege management vulnerabilityVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected …EPSS 0.27%21 Jul 2026

Source: NIST National Vulnerability Database (record CVE-2026-62494), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.