Oracle Contracts Integration CVE-2026-62443

Exploitation requires (1) network HTTP reachability to the Oracle Contracts Integration / EBS Internal Operations endpoint, and (2) human interaction from a person other than the attacker (CVSS UI:R) - typically a legitimate EBS user who must open a crafted link or trigger the malicious request in their browser session. No attacker authentication is needed (PR:N, unauthenticated). Limiting factors that reduce realistic risk: the mandatory victim interaction means the attack is not self-propagating or fully automatable, and it only applies to EBS releases 12.2.3-12.2.15 with the Contracts Integration module deployed and network-accessible to the attacker's chosen victim.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L yields 7.1 (High): network-reachable, low complexity, no privileges, but gated by required user interaction. The UI:R requirement is the dominant limiting factor - exploitation is not fully automatable because a human other than the attacker must act, which lowers real-world wormability compared to a straight AV:N/PR:N/UI:N flaw. No EPSS score, SSVC decision, POC, or KEV entry is present in the provided data, so exploitation likelihood cannot be quantified and there is no evidence of active exploitation. This reads as a genuine but not emergency priority: high integrity impact on ERP contract data warrants prompt patching, yet the interaction gate and absence of public exploit code argue against treating it as an actively-exploited zero-day. Note the confidentiality impact is explicitly N - an attacker corrupts or destroys data rather than reading it.

An attacker crafts a malicious HTTP request or link targeting the Contracts Integration endpoint and delivers it to an EBS user (e.g., via a phishing email or an embedded page). When that authenticated user opens or interacts with it, the request executes in their context and alters or deletes contract data and degrades service availability. No public exploit code is identified at time of analysis, and the required human interaction raises the effort needed for reliable exploitation.