Oracle E-Business Suite CVE-2026-62478

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L) with network/HTTP reachability to the EBS application tier hosting the Public Sector Financials module, running an affected version between 12.2.3 and 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is reliable. Limiting factors: the attacker cannot exploit anonymously (authentication is mandatory), the target must actually deploy the Public Sector Financials module and its Internal Operations component, and only EBS 12.2.3-12.2.15 are in scope; environments with no exposed application tier or strict account controls materially reduce the exposed attack surface.

The CVSS 3.1 base score of 8.8 reflects network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and only low privileges required (PR:L) with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - a serious, easily exploitable post-authentication issue. The key limiting factor is PR:L: an attacker must already hold a valid, low-privileged EBS account, so this is not a fully unauthenticated internet attack, which meaningfully narrows the exploiting population to insiders, compromised-credential holders, or self-registered users where enabled. No EPSS score, no SSVC decision, and no KEV listing were provided, and no public exploit code is identified at time of analysis, so real-world exploitation cannot currently be evidenced - but EBS's history as an attacker target and the low authentication bar make prompt patching prudent. Note: no EPSS/KEV data was supplied, so exploitation likelihood is inferred solely from the CVSS vector and product profile, not from confirmed telemetry.

An attacker who has obtained any low-privileged Oracle E-Business Suite account - via phishing, credential stuffing, or a rogue insider - sends crafted HTTP requests to the Public Sector Financials/Internal Operations functionality and exploits the flaw to escalate to full control of the module, reading and altering financial data. No user interaction is needed and attack complexity is low (AC:L), making exploitation straightforward once a foothold account exists; no public proof-of-concept has been identified at time of analysis.