What is the CVSS score of CVE-2026-62468?

CVE-2026-62468 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62468?

A critical vulnerability in Oracle E-Business Suite versions 12.2.14-12.2.15 (Enterprise Command Center component) allows attackers with low-privilege account access to read, create, delete, or…

How to fix or mitigate CVE-2026-62468?

Within 24 hours, inventory all Oracle E-Business Suite 12.2.14 and 12.2.15 instances in your environment and confirm which systems contain the Enterprise Command Center component and HTTP-accessible HR modules. Within 7 days, restrict HTTP network access to affected EBS systems to authorized administrative personnel only, enforce the principle of least privilege for HR module account access, and enable comprehensive audit logging and monitoring on all HR data read and modification operations. Within 30 days, engage Oracle support for security guidance, plan an upgrade path to Oracle E-Business Suite 12.2.16 or later (once available), and evaluate network segmentation strategies to isolate HR systems from general-access networks pending patch availability.

Oracle E-Business Suite CVE-2026-62468

EUVD-2026-47505 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c296-qc65-ffjg

Authentication Bypass Oracle Human Resources

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP access with a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; authorization bypass exposes and alters HR data (C:H/I:H) with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:46 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Command Center component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all HR-accessible data. Oracle rates this 8.1 and describes it as easily exploitable, requiring only network access and a low-privilege account; there is no public exploit identified at time of analysis and it is not in CISA KEV. The high confidentiality and integrity impact with no availability impact makes this a strong patch priority for organizations running affected EBS releases.

Technical ContextAI

Oracle E-Business Suite is Oracle's integrated enterprise resource planning (ERP) suite; the affected module is Oracle Human Resources (HRMS), specifically its Enterprise Command Center (ECC) component, which provides search-driven analytical dashboards layered over EBS data. The flaw is tagged as an authentication/authorization bypass, allowing an already-authenticated low-privilege user to reach data and operations that should be restricted, consistent with a broken access control root cause. No CWE was assigned in the source data, so the precise weakness class is inferred from the 'Authentication Bypass' tag and the CVSS confidentiality/integrity profile rather than a formal NVD/CWE mapping.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory) at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships EBS security fixes as cumulative CPU patches and no standalone fix version number was published in the input, so identify the exact CPU patch for your 12.2.x codeline from that advisory and apply it. Because exploitation requires a low-privileged authenticated account, interim compensating controls include restricting network reachability of the Enterprise Command Center and HR pages to trusted segments or VPN only, reviewing and tightening the EBS responsibilities and roles granted to low-privilege users to limit HR data access, and increasing audit logging and monitoring of HR data create/delete/modify operations - with the trade-off that access restrictions may disrupt legitimate self-service HR users and that these controls reduce but do not eliminate the underlying authorization weakness. Do not treat compensating controls as a substitute for the CPU patch.