What is the CVSS score of CVE-2026-62483?

CVE-2026-62483 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Project Contracts CVE-2026-62483

EUVD-2026-47516 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-989g-96c2-6mm9

Authentication Bypass Oracle Project Contracts

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via HTTP with low complexity; PR:L confirmed by requirement for valid EBS account; integrity-only impact with no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Project Contracts accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.

Technical ContextAI

Oracle Project Contracts is a module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform widely deployed in government, construction, and professional services industries. The affected component is Internal Operations, which governs project contract lifecycle management. The vulnerability class tagged as 'Authentication Bypass' in the EUVD record - combined with the CVSS PR:L (low privileges required) and S:U (no scope change) - suggests an improper authorization control rather than a full authentication bypass: a user authenticated at a lower privilege tier can issue crafted HTTP requests that bypass server-side access checks, modifying data objects within the contract module that should be restricted to higher-privilege roles. No CWE identifier was assigned by NVD or Oracle, which limits root-cause classification, but the pattern is consistent with CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization). No CPE string was included in the source data; affected versions are defined as Oracle Project Contracts 12.2.3 through 12.2.15.

RemediationAI

Apply the patches distributed as part of the Oracle Critical Patch Update for July 2026, available via Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched version numbers in the advisory summary; organizations should consult My Oracle Support for the specific patch ID applicable to their EBS 12.2.x release. As compensating controls while patching, administrators should audit and tighten EBS responsibility and role assignments for the Project Contracts Internal Operations component, removing any low-privileged users who do not require write access to contract records - this directly addresses the privilege boundary the flaw exploits. Network-layer controls such as restricting HTTP access to the EBS application tier to known internal IP ranges can reduce exposure surface, but will not mitigate the flaw for insiders already on the network. Note that broad role revocation may disrupt legitimate user workflows and should be coordinated with business owners before implementation.