What is the CVSS score of CVE-2026-62470?

CVE-2026-62470 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Self-Service HR CVE-2026-62470

EUVD-2026-47507 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wf7f-rv2r-444c

Authentication Bypass Information Disclosure Oracle Self Service Human Resources

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP component; low-privilege authentication required; confidentiality-only impact with no integrity or availability effect confirmed by description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Manager Self-Service). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large-scale enterprise resource planning platform. The Self-Service Human Resources (SSHR) module provides web-based HR self-service capabilities, with the Manager Self-Service sub-component enabling managers to view and manage subordinate employee data over HTTP. The vulnerability is tagged 'Authentication Bypass' by the EUVD reporter, though the CVSS vector assigns PR:L (low privilege required), indicating a more precise characterization is likely an authorization bypass - a low-privileged authenticated user circumvents access controls to reach data scoped to higher-privilege roles or other organizational units. No CWE is assigned in the NVD record, but the pattern matches CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control). Affected CPE corresponds to Oracle E-Business Suite SSHR versions 12.2.3 through 12.2.15.

RemediationAI

Apply the patches issued in Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish granular patch version identifiers outside of My Oracle Support (MOS), so administrators should consult the CPU advisory and corresponding MOS notes for the exact patch bundle applicable to their EBS version (12.2.3-12.2.15). As a compensating control prior to patching, restrict network access to the SSHR Manager Self-Service component at the web/application tier level - for example, limit access to trusted internal IP ranges via network ACLs or WAF rules, since the attack vector is HTTP (AV:N). Additionally, review and tighten EBS function security profiles and menu exclusions to enforce least privilege on Manager Self-Service menu items, which may reduce the blast radius even if the authorization bypass is not fully remediated. Note that menu-level restrictions in EBS are a partial mitigation and should not be treated as equivalent to the vendor patch.