What is the CVSS score of CVE-2026-62444?

CVE-2026-62444 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62444

EUVD-2026-47496 MEDIUM

Improper Authorization (CWE-285)

2026-07-21 secalert_us@oracle.com

GHSA-775f-phf8-2cv2

Authentication Bypass Oracle E Business Suite

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered client-side injection requiring victim interaction; scope change to browser context; no availability impact; PR:N confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle Contracts Integration is a module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform. The Internal Operations component is affected across EBS versions 12.2.3 through 12.2.15 per CPE-equivalent version data from EUVD-2026-47496. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) is characteristic of a reflected or stored XSS (CWE-79) or similar client-side injection flaw: network-delivered, low complexity, requires a victim to interact (UI:R), and the scope change (S:C) indicates that the exploitation impact crosses security boundaries - typically from the vulnerable web application context into the victim's browser session or a separate EBS module. The 'Authentication Bypass' tag suggests the attack may circumvent normal session or access controls, potentially allowing an unauthenticated attacker to leverage the victim's authenticated EBS session. No CWE is formally assigned in the source data, but the impact and vector are strongly consistent with client-side injection.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026 as the primary remediation; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU updates bundle all applicable patches, so administrators should apply the full July 2026 CPU rather than attempting selective application. The exact patched version number is not independently confirmed from the available data beyond the CPU bulletin reference - verify the specific patch ID against My Oracle Support (MOS) before deployment. As a compensating control prior to patching, restrict access to the Contracts Integration Internal Operations component to known trusted IP ranges via Oracle EBS function security or network-layer ACLs, noting that this may disrupt legitimate remote users. Organizations should also increase monitoring for anomalous session activity or unexpected data access originating from Contracts Integration workflows. User awareness of phishing links targeting EBS sessions is a supplementary measure given the UI:R requirement.