What is the CVSS score of CVE-2026-62479?

CVE-2026-62479 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Public Sector Financials CVE-2026-62479

EUVD-2026-47513 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-782x-53q3-wrhf

Authentication Bypass Oracle Public Sector Financials

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by description requiring authenticated low-privileged attacker; UI:R and S:C consistent with client-side injection affecting cross-component session scope; no availability impact stated.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Public Sector Financials, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large integrated enterprise resource planning suite; Oracle Public Sector Financials is a specialized module targeting government and public sector financial management. The affected component is 'Internal Operations,' which processes HTTP requests from authenticated users within the EBS web tier. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is structurally consistent with a stored or reflected client-side injection vulnerability such as Cross-Site Scripting (XSS) - the scope change (S:C) and required user interaction (UI:R) are hallmarks of vulnerabilities where attacker-supplied content is rendered in a victim's browser session, potentially crossing trust boundaries into other EBS modules. No CWE is formally assigned in the advisory, though the 'Authentication Bypass' tag in the intelligence data suggests the exploitation may also involve bypassing intra-application authorization checks at the data or function level. Affected versions span 12.2.3 through 12.2.15 per NVD and EUVD records.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), which addresses this vulnerability per Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patched build version strings in the public CPU document; organizations should consult My Oracle Support (MOS) for the specific patch number targeting Oracle E-Business Suite 12.2.x. Since Oracle EBS CPUs are cumulative, applying the July 2026 CPU will also include prior fixes. As a compensating control pending patching, restrict access to the Oracle Public Sector Financials Internal Operations component to only those user roles that require it, reducing the pool of low-privileged accounts that could be used as an attacker starting point. Additionally, enforcing Content Security Policy (CSP) headers at the EBS web tier can limit the impact of any client-side injection by restricting script execution contexts, though this is an imperfect mitigation and does not address the underlying authorization issue. No workaround is specified in the advisory.