Oracle E-Business Suite CVE-2026-62466

Exploitation requires the attacker to already possess high privileges (CVSS PR:H) within Oracle Human Resources / E-Business Suite and network access over HTTP to the EBS application tier; the vulnerable surface is specifically the Data Removal Tool component of the Oracle Human Resources product on versions 12.2.3-12.2.15. Limiting factors: this is NOT unauthenticated - a pre-existing high-privilege HR/EBS account is mandatory, which substantially narrows the attacker population to trusted administrators, insiders, or holders of stolen elevated credentials; no user interaction is required (UI:N) and complexity is low (AC:L), so once the privilege prerequisite is met, exploitation is straightforward against affected versions.

The CVSS 3.1 base score of 7.2 (High) reflects a network-reachable (AV:N), low-complexity (AC:L) issue with full CIA impact (C:H/I:H/A:H), but the requirement for high privileges (PR:H) is the dominant mitigating factor - the attacker must already hold an elevated EBS/HR account before exploitation. There is no EPSS score, no POC, and no CISA KEV listing in the provided data, so all signals point to a patch-on-cycle priority rather than an emergency. Oracle CPU vulnerabilities are historically attractive to attackers over time and EBS is a high-value target holding sensitive HR/PII data, so the practical risk is meaningful for internet-exposed or loosely-governed EBS deployments where privileged accounts are broadly held; however, absence of exploitation evidence and the PR:H barrier keep real-world urgency moderate. No conflicting signals were identified between the vector and the description - both agree on network vector with high privileges required.

An attacker who has obtained a high-privileged Oracle HR account - for example a compromised HR administrator credential or a malicious insider - sends crafted HTTP requests to the Data Removal Tool component of the EBS application tier and abuses it to take over the Human Resources module, reading, altering, or destroying personnel data. Because attack complexity is low and no user interaction is needed, the action is repeatable once privileged access is held; no public POC is currently known.