What is the CVSS score of CVE-2026-62466?

CVE-2026-62466 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62466?

Oracle E-Business Suite Human Resources module (versions 12.2.3-12.2.15) contains a critical vulnerability enabling high-privileged administrators to achieve complete compromise of the HR…

How to fix or mitigate CVE-2026-62466?

Within 24 hours: identify and catalog all Oracle E-Business Suite instances in versions 12.2.3-12.2.15 running the Human Resources module in production and development environments; immediately audit high-privileged administrative access and remove unnecessary accounts. Within 7 days: implement enhanced logging and monitoring of all privileged HR module access, enforce multi-factor authentication on all administrative accounts connecting to affected systems, and isolate HR systems from lower-security networks if operationally feasible. Within 30 days: contact Oracle directly to confirm patch status and obtain a committed delivery timeline; develop and schedule an upgrade plan to Oracle E-Business Suite 12.2.16 or later versions when released, making this deployment highest priority given full confidentiality, integrity, and availability impact.

Oracle E-Business Suite CVE-2026-62466

EUVD-2026-47504 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fv8f-3qm3-96cq

Authentication Bypass Oracle Human Resources

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP access with low complexity but a pre-existing high-privilege HR account is required (PR:H); full takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:45 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in takeover of Oracle Human Resources. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, resulting in complete takeover of the Human Resources application with confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.2), the flaw requires existing elevated privileges (PR:H) but no user interaction and has low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle E-Business Suite (EBS), Oracle's integrated enterprise resource planning and human capital management suite, specifically the Oracle Human Resources (HR/HCM) product and its Data Removal Tool component - a utility used for purging or scrubbing personnel data. EBS 12.2.x is a web-based application tier served over HTTP, which is consistent with the AV:N (network) vector. No CWE was assigned in the source data, so the precise weakness class (e.g., improper authorization, injection, or insecure data-handling within the removal workflow) cannot be confirmed; Oracle's terse CPU advisory language of 'takeover' typically indicates the component can be abused by an authorized user to gain control over the whole HR module rather than a single-record flaw.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-released remediation for EBS 12.2.3 through 12.2.15; Oracle publishes the specific patch numbers per version within that CPU, so administrators should map their exact 12.2.x level to the corresponding CPU patch rather than relying on a single version string (no standalone fixed-version identifier was included in the source data). As compensating controls until patching, restrict and audit accounts that hold high HR privileges since exploitation requires PR:H, limit HTTP access to the EBS application tier to trusted internal networks or VPN and avoid direct internet exposure of the HR endpoints, and tightly govern access to the Data Removal Tool functionality; note that narrowing privileged access or network reachability may disrupt legitimate HR administrators and integrations, so validate role assignments before enforcing.