Oracle Work in Process CVE-2026-62462

Exploitation requires the attacker to possess a valid Oracle E-Business Suite user account with at minimum low-level privileges - the CVSS vector specifies PR:L, confirming authenticated access is necessary. The attacker must have network connectivity to the EBS application tier over HTTP (AV:N). No user interaction from a victim is required (UI:N), and no special configuration beyond a standard EBS deployment running versions 12.2.3 through 12.2.15 is indicated. The specific Internal Operations component of Work in Process must be accessible to the attacker's account; deployments that restrict WIP module access to dedicated manufacturing roles may have a reduced exposure surface, though this is not confirmed as a complete mitigation. What limits exploitation: the PR:L requirement means unauthenticated external attackers cannot directly exploit this without first obtaining credentials; organizations with strict account provisioning, MFA enforcement on EBS, or network segmentation isolating the EBS tier will face meaningfully harder exploitation paths.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) presents a consistent, high-severity signal: network-reachable over HTTP, low complexity, requiring only a low-privileged account, and yielding full CIA compromise without any user interaction - even a mid-sized municipal IT team in gniezno running Oracle EBS should treat this as an urgent patching priority rather than a deferred maintenance item. No EPSS score was provided in the intelligence data, and the vulnerability is not currently listed in the CISA KEV catalog, meaning active exploitation is not confirmed at time of analysis. No public POC has been identified. The SSVC technical impact dimension is 'total' given the described system takeover, and the 'automatable' dimension appears high given AC:L and UI:N - once a low-privilege credential is obtained, exploitation requires no special timing or interaction. The only meaningful exploitation barrier is the PR:L requirement, meaning an attacker must first possess a valid low-privileged EBS account; this meaningfully reduces the attack surface compared to unauthenticated vulnerabilities but remains a realistic threat in environments with shared credentials, weak password policies, or broad user provisioning. The 'Information Disclosure' tag from ENISA conflicts with the full-takeover impact stated in the NVD description - this discrepancy should be noted and the higher-impact framing from Oracle's own advisory treated as authoritative.

An attacker with a valid low-privileged Oracle EBS account (such as a general business user or a compromised shared credential) sends a crafted HTTP request targeting the Internal Operations component of the Work in Process module. Due to the low attack complexity, no specialized tooling or timing is required - the attacker manipulates the request to trigger the underlying flaw, resulting in full control over the Work in Process application context, including the ability to read, modify, or destroy production order data and availability of the service. No public POC has been identified, but the AC:L/PR:L profile makes development of working exploit code straightforward for a moderately skilled attacker.