What is the CVSS score of CVE-2026-62451?

CVE-2026-62451 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Work in Process are affected by CVE-2026-62451?

Oracle Work in Process (WIP) module in E-Business Suite versions 12.2.14-12.2.15 contains an authorization bypass allowing low-privileged users to read, modify, or delete all manufacturing data…

How to fix or mitigate CVE-2026-62451?

Within 24 hours: Identify all systems running Oracle E-Business Suite WIP 12.2.14 or 12.2.15 and document their network accessibility; review access logs for unauthorized activity by low-privileged accounts. Within 7 days: Restrict HTTP network access to WIP systems to only authorized users and systems; enable audit logging for all WIP data access and modification operations. Within 30 days: Contact Oracle Support for patch availability timeline; develop and document an upgrade plan for affected systems once patches are released.

Oracle Work in Process CVE-2026-62451

EUVD-2026-47499 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7w52-542v-2qwq

Authentication Bypass Oracle Work In Process

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP, low complexity, no interaction, but a valid low-privileged EBS account is required (PR:L); high confidentiality and integrity impact, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:48 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Work in Process (WIP) is the shop-floor/manufacturing execution module within the Oracle E-Business Suite (EBS) application stack, running on the EBS application tier (Oracle Application Server / WebLogic fronting Oracle Forms and OA Framework web pages backed by an Oracle database). The affected component is 'Internal Operations'. Oracle publishes this under its quarterly Critical Patch Update (July 2026) and does not assign an NVD CWE (CWE: N/A); however, the intelligence tag 'Authentication Bypass' combined with the vector (PR:L, C:H/I:H) points to a broken-access-control / authorization class of flaw (CWE-284/CWE-862-style) where an authenticated user can reach data and operations beyond their intended privilege boundary via crafted HTTP requests to the EBS web tier. The 12.2.x codeline is the current EBS 12.2 release family.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Work in Process 12.2.14-12.2.15 releases; Oracle CPUs are cumulative, so applying the latest EBS 12.2 CPU patch remediates this issue (no standalone fix build number was published in the provided data, so consult the CPU patch matrix for the exact patch ID). Until patched, reduce exposure by restricting network reachability of the EBS application tier - do not expose EBS/WIP web endpoints directly to the internet, place them behind VPN or an authenticated reverse proxy, and tighten which internal user populations can reach the Internal Operations pages (trade-off: may disrupt legitimate self-service or partner integrations). Because exploitation needs a low-privileged account, also review and prune WIP/EBS user accounts and responsibilities, enforce least privilege, rotate weak credentials, and increase auditing of WIP data-modifying transactions (trade-off: added audit overhead but no functional loss). These are compensating controls only; the vendor CPU patch is the definitive fix.