What is the CVSS score of CVE-2026-62480?

CVE-2026-62480 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Public Sector Financials CVE-2026-62480

EUVD-2026-47514 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-293x-f7pv-38xc

Authentication Bypass Oracle Public Sector Financials

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP attack requiring low-privilege credentials; confidentiality-only impact with no integrity or availability effects, and no scope change confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.

Technical ContextAI

Oracle Public Sector Financials is a specialized module within Oracle E-Business Suite (EBS) designed for government and public-sector organizations to manage budgeting, procurement, and financial operations. The affected component, Internal Operations, is exposed over HTTP and processes requests from authenticated EBS users. The vulnerability exists across all release 12 patch levels from 12.2.3 through 12.2.15 of the EBS stack. No CWE identifier was assigned by NVD or Oracle, limiting precise root-cause classification; however, the 'Authentication Bypass' tag in ENISA EUVD intelligence (EUVD-2026-47514) combined with the CVSS confidentiality-only impact suggests a broken access control or authorization bypass pattern (consistent with CWE-284 or CWE-863) rather than a memory-safety issue. The attack vector is network (AV:N) via HTTP with low attack complexity (AC:L), indicating a straightforward HTTP request is sufficient to trigger the flaw.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so organizations should apply the full July 2026 CPU to bring affected EBS 12.2.x instances to the patched state; the exact remediated version number is not independently confirmed in available intelligence and should be verified directly against Oracle's advisory. If immediate patching is not feasible, compensating controls should include restricting network access to the EBS Internal Operations component to only authorized users via firewall or network segmentation, reducing the pool of accounts that can reach the vulnerable endpoint. Auditing EBS user accounts to enforce least-privilege and revoking unnecessary low-privileged accounts limits the attacker base. Note that network segmentation does not eliminate risk if attackers already hold valid EBS credentials from phishing or credential reuse. Monitor EBS application logs for anomalous queries against the Internal Operations component as a detection measure.