CVE-2026-60951: Oracle Time and Labor Auth Bypass Flaw

CVE-2026-60951 Overview

CVE-2026-60951 is a high-severity vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle Time and Labor accessible data. Oracle addressed the vulnerability in the Oracle Critical Patch Update July 2026.

Critical Impact
An authenticated network attacker can compromise the confidentiality and integrity of all data accessible to Oracle Time and Labor, including workforce time records and payroll-adjacent data.

Affected Products

Oracle E-Business Suite — Oracle Time and Labor version 12.2.3
Oracle E-Business Suite — Oracle Time and Labor versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Time and Labor version 12.2.15

Discovery Timeline

2026-07-21 - Oracle publishes the Critical Patch Update advisory covering this issue
2026-07-21 - CVE-2026-60951 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60951

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Time and Labor within Oracle E-Business Suite. An attacker requires only low-level authenticated access and network reachability over HTTP to the E-Business Suite web tier. No user interaction is required to trigger the flaw. Oracle's advisory characterizes the issue as easily exploitable, meaning known preconditions are minimal for a valid application session.

Successful exploitation impacts both confidentiality and integrity. An attacker gains unauthorized read access to all data accessible by Oracle Time and Labor, and can create, delete, or modify that data. Availability is not directly affected according to the vendor's scoring. The scope remains unchanged, so the compromise is bounded to the vulnerable application and its data set.

The EPSS score is 0.392% with a percentile of 31.707 as of 2026-07-23, indicating a low current probability of observed exploitation. However, Oracle E-Business Suite instances are frequent targets given their role in finance and workforce operations.

Root Cause

Oracle does not publish detailed root-cause information for Critical Patch Update issues. The advisory lists the vulnerability under the Internal Operations component of Oracle Time and Labor, and the impact profile (authenticated, network, high confidentiality and integrity impact) is consistent with insufficient authorization enforcement on a server-side operation exposed over HTTP. Refer to the Oracle Critical Patch Update July 2026 for the authoritative advisory.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite web tier. The attacker must hold a valid low-privileged application account. Once authenticated, the attacker sends crafted HTTP requests to the affected Time and Labor endpoints to read or alter records that should be restricted. No client-side interaction is required from other users, which enables scripted, repeatable exploitation from a foothold account.

No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60951

Indicators of Compromise

Unexpected HTTP requests from low-privileged EBS user sessions to Oracle Time and Labor Internal Operations endpoints under the /OA_HTML/ path.
Anomalous INSERT, UPDATE, or DELETE operations against Oracle Time and Labor (HXT_* and HXC_*) tables outside of scheduled batch windows.
Application audit records showing data modifications by user accounts that historically only performed read operations.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for Time and Labor responsibilities.
Correlate database-level auditing on Time and Labor schema objects with the originating application session and source IP.
Alert on privilege pattern deviations where standard employee self-service accounts invoke Internal Operations functions.

Monitoring Recommendations

Forward Oracle HTTP Server access logs and EBS FND audit tables to a centralized analytics platform for behavioral baselining.
Monitor for spikes in 4xx/5xx responses on Time and Labor URLs, which can indicate exploitation probing.
Track outbound egress from the EBS application tier to identify data staging following unauthorized reads.

How to Mitigate CVE-2026-60951

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all Time and Labor deployments running versions 12.2.3 through 12.2.15.
Inventory user accounts with any Time and Labor responsibility and revoke access that is not operationally required.
Restrict network exposure of the E-Business Suite web tier to trusted networks and VPN-terminated sessions.

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update July 2026. Administrators should follow the CPU documentation to apply the corresponding Oracle E-Business Suite 12.2 patchset and any prerequisite technology stack updates. Validate the patch in a non-production environment before rolling to production.

Workarounds

Temporarily remove the Oracle Time and Labor responsibilities from non-essential low-privileged users until patching completes.
Place a reverse proxy or web application firewall in front of the EBS web tier with rules that constrain access to Internal Operations URLs by role or source network.
Increase auditing granularity on Time and Labor schema objects to detect exploitation attempts while patching is in progress.

bash

# Example: enable database-level auditing on Time and Labor tables
sqlplus / as sysdba
AUDIT INSERT, UPDATE, DELETE ON HXT.HXT_TIMECARDS BY ACCESS;
AUDIT INSERT, UPDATE, DELETE ON HXC.HXC_TIME_BUILDING_BLOCKS BY ACCESS;
AUDIT SELECT ON HXC.HXC_TIME_ATTRIBUTES BY ACCESS;