Main Vulnerability Database Vulnerabilities #VU160188

Improper input validation in Oracle E-Business Suite and Oracle Time and Labor - CVE-2026-61012

Published: November 7, 2026

Vulnerability identifier: #VU160188

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-61012

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to modify data and cause limited service disruption.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Time and Labor in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to modify data and cause limited service disruption.

Affected software

Oracle E-Business Suite
Oracle Time and Labor

How to mitigate CVE-2026-61012

Install updates from vendor's website.

External References

https://www.oracle.com/security-alerts/cpujul2026.html

Related Security Bulletins