Oracle Email Center CVE-2026-62448

Exploitation requires that a person other than the attacker - specifically an individual with access to Oracle Email Center - performs active interaction with attacker-controlled content, such as clicking a crafted HTTP link or loading a malicious request within the Email Center application context (UI:R per CVSS vector). The attacker requires no authentication credentials against the target system (PR:N per CVSS vector). The vulnerability is present in standard supported configurations of Oracle Email Center versions 12.2.3 through 12.2.15 within Oracle EBS; no non-default feature flag, special configuration setting, or atypical deployment mode is indicated as a prerequisite. Limiting factors include: the mandatory human interaction step (preventing fully automated exploitation or scanning-based mass compromise), network reachability of the EBS HTTP interface (organizations with EBS deployed behind internal network perimeters or VPN significantly reduce exposure to external attackers), and the explicit version constraint (only 12.2.3-12.2.15; installations outside this range are not confirmed affected by available data).

The CVSS 3.1 score of 8.2 is substantiated by a network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), a scope change (S:C), and high confidentiality impact - a combination that reflects a genuinely high-severity flaw rather than score inflation. The mandatory human interaction requirement (UI:R) is the sole intrinsic mitigating factor, preventing fully automated or worm-like exploitation and implying a reflected-attack or social-engineering delivery mechanism, which meaningfully reduces mass exploitation risk. No EPSS score was available in the provided data, so probabilistic exploitation likelihood cannot be quantified; however, the breadth of the affected version range (12.2.3-12.2.15, covering over a decade of supported releases) means a substantial proportion of active EBS deployments are exposed, and even a mid-sized municipal IT team in sanok running any covered EBS version should treat this as an urgent patching priority rather than a deferred item. The 'Authentication Bypass' tag supplied by Oracle's security team elevates concern beyond the generic CVSS narrative, as it signals that the access control mechanism itself is bypassable. No CISA KEV listing or public proof-of-concept has been identified, so confirmed in-the-wild exploitation is absent at time of analysis - though the absence of a KEV listing does not preclude targeted private exploitation given the value of EBS data.

An attacker identifies an Oracle E-Business Suite deployment with the Email Center interface accessible over HTTP and crafts a malicious request or URL targeting the authentication bypass in the Message Component. The attacker delivers this payload to a legitimate Email Center user via phishing email, embedded link, or other social engineering, and upon the user interacting with it, the bypass triggers - granting the attacker unauthorized read access to all data accessible within Oracle Email Center and limited write access, with potential cascade into additional EBS modules through the shared application scope. No public proof-of-concept code has been identified at time of analysis.