What is the CVSS score of CVE-2026-62478?

CVE-2026-62478 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62478?

A high-severity account takeover vulnerability (CVE-2026-62478, CVSS 8.8) in Oracle Public Sector Financials module allows complete system compromise with high impact to confidentiality, integrity,…

How to fix or mitigate CVE-2026-62478?

Within 24 hours, inventory all Oracle E-Business Suite instances running the Public Sector Financials module and document current patch levels to establish baseline exposure. Within 7 days, obtain the July 2026 Critical Patch Update, thoroughly test it in an isolated environment that mirrors production configuration and workload patterns, and finalize a deployment schedule. Within 30 days, deploy the July 2026 Critical Patch Update to all production Oracle E-Business Suite instances running Public Sector Financials, followed by non-production systems, ensuring continuity of critical financial operations.

Oracle E-Business Suite CVE-2026-62478

EUVD-2026-47512 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-9j7w-jxcm-7hgw

Privilege Escalation Oracle Public Sector Financials

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach and low complexity, but a valid low-privileged EBS account is required (PR:L); full module takeover yields high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:42 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large, multi-module ERP web application; the affected Public Sector Financials module handles government/public-sector financial management and is reached through EBS's HTTP-based application tier (Oracle Application Server/WebLogic front-ending Oracle Database). The flaw sits in the 'Internal Operations' component, and Oracle classifies successful exploitation as a 'takeover' of the sub-product, meaning the attacker gains full read/write control of the module's data and logic. No CWE was assigned (CWE: N/A) and Oracle's advisories are intentionally sparse, so the precise root cause (e.g., injection, access-control bypass, or authorization flaw) cannot be confirmed from the available data; the vendor tag 'Information Disclosure' hints at a confidentiality-relevant weakness, though the CVSS vector shows full C/I/A impact.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue across the affected 12.2.x line - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publish standalone fixed build numbers, so apply the CPU patch set corresponding to your EBS 12.2 release rather than an invented version. Because exploitation requires a low-privileged account, interim compensating controls include tightening EBS user provisioning and disabling any self-registration, reducing the number of accounts with access to Public Sector Financials responsibilities, restricting network access to the EBS application tier to trusted segments/VPN, and increasing monitoring of Internal Operations and Public Sector Financials transactions for anomalous activity - with the trade-off that these controls reduce but do not eliminate insider/compromised-credential risk and may disrupt legitimate self-service users. Patch as the primary remedy; treat access restrictions as bridging controls only.