Description
Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Labor Distribution. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-07-21
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Labor Distribution product (Oracle E‑Business Suite component) has a flaw that permits a low‑privileged user over HTTP to cause a partial denial of service. The weakness stems from improper handling of malformed or excessive requests, leading to resource exhaustion. As a result, only availability is impacted, with no compromise of confidentiality or integrity.

Affected Systems

Oracle Labor Distribution versions 12.2.3 through 12.2.15 are affected. This includes all supported releases within that range as documented in the Oracle CPU advisory for July 2026.

Risk and Exploitability

The CVSS base score of 3.1 indicates a low severity impact, while the EPSS score of less than 1% indicates a very unlikely exploit scenario. The vulnerability is not listed in the CISA KEV catalog. Remote attack via HTTP is required, and only a low‑privilege account is necessary on the target network.

Generated by OpenCVE AI on August 2, 2026 at 20:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a non‑affected release such as 12.2.16 or later, following Oracle's advisory.
  • Restrict unsolicited HTTP access to the Labor Distribution web interface via network controls or a web application firewall, limiting the attack surface for low‑privileged users.
  • Implement rate limiting and monitor HTTP traffic and logs for repeated or unusually large requests that could indicate attempted denial‑of‑service activity.

Generated by OpenCVE AI on August 2, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service via HTTP in Oracle Labor Distribution

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Denial of Service in Oracle Labor Distribution
Weaknesses CWE-284
CWE-730

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Denial of Service in Oracle Labor Distribution
Weaknesses CWE-284
CWE-730

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Labor Distribution. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle labor Distribution
CPEs cpe:2.3:a:oracle:labor_distribution:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle labor Distribution
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle E-business Suite Labor Distribution
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T16:55:09.178Z

Reserved: 2026-07-08T15:51:55.603Z

Link: CVE-2026-60936

cve-icon Vulnrichment

Updated: 2026-07-24T16:55:04.046Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:28.330

Modified: 2026-07-29T17:16:13.110

Link: CVE-2026-60936

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:30:04Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption