What is the CVSS score of CVE-2026-62443?

CVE-2026-62443 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Contracts Integration are affected by CVE-2026-62443?

Oracle E-Business Suite Contracts Integration module (versions 12.2.3-12.2.15) contains a vulnerability enabling unauthorized modification or deletion of contract data through socially engineered…

How to fix or mitigate CVE-2026-62443?

Within 24 hours, issue a security alert to all users advising against clicking unexpected links related to contract operations and identify all EBS instances running versions 12.2.3-12.2.15 in your environment. Within 7 days, deploy Web Application Firewall rules to validate and restrict HTTP requests targeting the Contracts Integration module, restrict network access to this module to authorized users and systems only, and enable detailed audit logging of all contract data modifications. Within 30 days, begin upgrade planning for affected EBS instances to versions 12.2.16 or later, establish a change control review process for all contract modifications pending remediation, and establish real-time alerts for anomalous contract data creation or deletion activity.

Oracle Contracts Integration CVE-2026-62443

EUVD-2026-47495 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-21 secalert_us@oracle.com

GHSA-7gqh-c5fm-3g69

Denial Of Service Oracle CSRF E Business Suite

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network HTTP reach with no attacker auth (AV:N/PR:N) but a required victim action (UI:R); integrity fully impacted (I:H), availability partial (A:L), no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:49 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contracts Integration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Contracts Integration. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).

AnalysisAI

Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.

Technical ContextAI

Oracle E-Business Suite is Oracle's integrated enterprise resource planning (ERP) web application stack; Contracts Integration is a sub-module handling contract data exchange, exposed over HTTP through the EBS application tier (Oracle Application Server / WebLogic front end). The flaw is reachable network-side via HTTP but requires a victim user to take an action (UI:R), a pattern consistent with request-forgery or reflected-injection style weaknesses where the attacker rides an authenticated user's browser session or induces a privileged action. Oracle does not assign a CWE for this entry (CWE: N/A), so the precise root-cause class is not published; the CVSS impact profile (C:N/I:H/A:L) indicates an integrity-centric defect rather than an information-disclosure or memory-corruption bug.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to all EBS 12.2 environments running Contracts Integration; Oracle does not publish a standalone fixed build number in the provided data, so follow the CPU's patch matrix for release 12.2.3-12.2.15. Because exploitation requires tricking an authenticated user via HTTP, interim compensating controls until patching include restricting network access to the EBS application tier to trusted internal networks or VPN (trade-off: may block legitimate remote/partner access), placing the Contracts Integration URLs behind a WAF or reverse proxy that enforces anti-CSRF tokens and referer/origin checks, and enforcing short session timeouts plus user awareness so employees do not follow untrusted links into EBS (trade-off: added friction, no guarantee against a determined social-engineering lure). Do not expose the EBS interface directly to the public internet.