Oracle EBS CVE-2026-62474

Exploitation requires a valid, low-privileged account within Oracle E-Business Suite (PR:L per CVSS) - any authenticated user with access to the application qualifies. Network access to the EBS instance via HTTP is required (AV:N). No user interaction from a victim is needed (UI:N), and no specific non-default configuration or special feature enablement is described as a prerequisite. The vulnerability is present across the default Lease Authoring workflow in EBS versions 12.2.3 through 12.2.15. Limiting factors include: (1) an account with at least low-level EBS privileges is mandatory - unauthenticated external attackers cannot exploit this directly; (2) impact is bounded to a subset of lease and finance data rather than full system compromise; (3) the partial DoS does not result in complete service unavailability.

The CVSS 3.1 base score of 6.3 (Medium) reflects a network-accessible, low-complexity flaw requiring only low-privileged authentication and no user interaction, with unchanged scope and limited CIA impacts. The AV:N/AC:L/PR:L/UI:N profile indicates this is straightforward to exploit for any authenticated EBS user - no special chaining or social engineering is needed. However, all three impact metrics are set to Low (C:L/I:L/A:L), capping the blast radius: data exposure is partial, write access is restricted to a subset of accessible data, and the DoS is partial rather than complete. EPSS data is not available for this CVE, preventing a statistical probability estimate. The vulnerability is not present in the CISA KEV catalog and no public proof-of-concept code has been identified, suggesting it has not yet been weaponized broadly. Real-world risk is moderate: the low-privilege requirement means any internal or externally authenticated EBS user could exploit this, which is relevant in environments where EBS is exposed beyond a trusted perimeter or where least-privilege enforcement is weak. The partial nature of the impacts limits immediate business impact but the integrity vector (unauthorized inserts/updates/deletes to lease data) could have downstream financial reporting consequences in lease-heavy organizations.

An internal employee or external contractor with a valid, low-privileged Oracle EBS account sends a crafted HTTP request targeting the Lease Authoring component - for example, a manipulated form submission or URL parameter - exploiting the authorization or input validation weakness. The attacker is then able to read lease financial records they are not entitled to view, insert or modify contract data to alter financial terms, or trigger resource exhaustion that degrades the Lease Authoring service for other users. No public proof-of-concept code is known to exist, but the low-complexity, no-user-interaction profile means the attack is straightforward for any technically capable authenticated user.