What is the CVSS score of CVE-2026-62482?

CVE-2026-62482 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Public Sector Financials CVE-2026-62482

EUVD-2026-47515 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-f3m3-xp8g-jj26

Authentication Bypass Oracle Public Sector Financials

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable HTTP component requiring a valid low-privilege account; partial data read/write impact only, no availability or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.

Technical ContextAI

Oracle Public Sector Financials is a module within the Oracle E-Business Suite (EBS) platform, a large-scale enterprise resource planning (ERP) system widely deployed by government and public sector organizations. The vulnerable component is 'Internal Operations,' which handles back-office financial processing logic accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the vulnerability is reachable over the network without complexity, requiring only a valid low-privilege user session. No CWE identifier was assigned, but the 'Authentication Bypass' tag and the nature of the impact (unauthorized data read/write) suggest an authorization control flaw - likely improper access control or broken object-level authorization within the Internal Operations component - rather than a classic authentication bypass at the session layer. Affected versions span 12.2.3 through 12.2.15 per Oracle's advisory and ENISA EUVD-2026-47515.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle Public Sector Financials 12.2.3-12.2.15. The exact patched version sub-release is not independently confirmed beyond the CPU advisory reference. As a compensating control prior to patching, restrict HTTP access to the Internal Operations component to only those user accounts and network segments that genuinely require it - Oracle EBS function security and menu exclusions can limit exposure of the vulnerable component to the minimum required user population. Organizations should also review audit logs for the Internal Operations component for anomalous low-privilege access patterns that may indicate prior exploitation. Note that function-security restrictions within EBS do not eliminate the underlying vulnerability but reduce the pool of accounts that could trigger it.