Oracle Public Sector Financials CVE-2026-62479

Exploitation requires the attacker to hold a valid Oracle E-Business Suite account with at least low-level privileges (PR:L) - unauthenticated exploitation is not supported by the CVSS vector. The target environment must be running Oracle Public Sector Financials versions 12.2.3 through 12.2.15 with the Internal Operations component accessible over HTTP. A separate victim user with a live EBS session must interact with attacker-influenced content (UI:R) for the attack to succeed - passive exploitation without victim interaction is not possible under this vulnerability class. The scope change condition (S:C) requires that the EBS deployment include other products or modules within the same application trust boundary that can be secondarily impacted. Factors limiting exploitation include: mandatory victim interaction eliminates fully automated mass exploitation; attacker must already possess authenticated EBS credentials; impact is bounded to data confidentiality and integrity (no availability or code execution impact); and the affected module is specific to public sector deployments, limiting the exposed population.

The CVSS 3.1 base score of 5.4 (Medium) reflects meaningful but bounded risk: network-accessible, low complexity, but constrained by the requirement for low-privilege authentication (PR:L) and mandatory victim interaction (UI:R). The scope change (S:C) is the most significant risk amplifier here - it means exploitation is not confined to the Public Sector Financials module and could affect downstream EBS components sharing the same session context. No EPSS data was provided in the source intelligence, and no CISA KEV listing or public POC is known at time of analysis, which reduces urgency compared to a similarly scored KEV entry. The 'Authentication Bypass' tag in the intelligence metadata introduces a tension with the PR:L CVSS metric: PR:L indicates an authenticated low-privilege actor is needed, yet 'Authentication Bypass' implies circumventing access controls. This could mean an intra-application authorization bypass (access to data above one's privilege level) rather than a pre-authentication bypass - the CVSS vector should be treated as authoritative here, but defenders should verify this distinction with Oracle's advisory. Impact is limited to confidentiality (C:L) and integrity (I:L) with no availability impact (A:N), meaning this is a data exposure and tampering risk, not a denial-of-service or remote code execution scenario.

An attacker with a valid low-privileged Oracle EBS account crafts a malicious HTTP request targeting the Internal Operations component of Oracle Public Sector Financials and embeds attacker-controlled content (e.g., a script payload or manipulated data reference) that is subsequently rendered or processed in the context of a higher-privileged victim user's session. The victim interacts with the affected EBS page - for example, by reviewing a financial record or report - triggering the payload, which reads or modifies data accessible to the victim's session and may propagate effects to other EBS components sharing that session scope. No public proof-of-concept code is known to exist at time of analysis.