Oracle E-Business Suite CVE-2026-62468

Exploitation requires a low-privileged but authenticated account on the target Oracle Human Resources instance (CVSS PR:L) with HTTP network reachability to the Enterprise Command Center component of Oracle E-Business Suite; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The target must be running an affected supported version, Oracle EBS Human Resources 12.2.14 through 12.2.15. The principal limiting factor is that fully unauthenticated exploitation is not supported by the vector - the attacker must first obtain a valid low-privilege session or credentials - and that only the confidentiality and integrity of HR-accessible data are at risk, with no availability or denial-of-service impact (A:N).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High) signals genuinely low exploitation friction: remote over HTTP, low attack complexity, no user interaction, and only a low-privilege account required, with high confidentiality and integrity loss but no availability impact. Oracle's own 'easily exploitable' language reinforces the low-complexity read. Countervailing signals lowering immediate urgency: it is not listed in CISA KEV (no confirmed active exploitation), no public POC or exploit code was provided in the input, and no EPSS score was supplied, so probabilistic exploitation likelihood is unknown. The key limiting factor is the PR:L requirement - an attacker needs a valid, if low-privileged, EBS/HR account or session - which makes this an insider or post-foothold data-access escalation rather than a fully unauthenticated internet-facing worm. Net: a real high-priority patch item for any exposed EBS 12.2.14-12.2.15 deployment, but currently targeted-risk rather than mass-exploited.

A user holding only a low-privileged EBS Human Resources account, or an attacker who has phished or otherwise obtained such credentials, sends crafted HTTP requests to the Enterprise Command Center component and bypasses authorization controls to read, alter, or delete HR records well beyond their assigned responsibility. Given AV:N/AC:L/PR:L/UI:N, the attack needs no victim interaction and is low-complexity, though no public POC was provided in the input.