What is the CVSS score of CVE-2026-62484?

CVE-2026-62484 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62484

EUVD-2026-47517 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-ff5r-g2gv-9vfq

Authentication Bypass Oracle E Business Suite

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

Consistent with Oracle's published vector - network reachable over HTTP, no credentials required, high complexity precondition, integrity-only impact with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.

Technical ContextAI

Oracle E-Business Suite (EBS) is a widely-deployed enterprise ERP platform; the Contracts Integration component manages contract lifecycle operations within the Internal Operations module. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable over HTTP with no authentication requirement, but the high attack complexity (AC:H) typically reflects a race condition, specific system state dependency, timing window, or non-standard protocol interaction that must be precisely achieved. The 'Authentication Bypass' tag suggests the root weakness involves circumventing identity or session validation controls, though no formal CWE has been assigned in available data. Scope is unchanged (S:U), meaning exploitation is confined to the Contracts Integration component and does not cascade to other Oracle EBS modules. Affected versions span 12.2.3 through 12.2.15 per Oracle's confirmed advisory and EUVD-2026-47517.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), announced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. Oracle does not publicly disclose specific patched version identifiers outside their CPU documentation; consult the CPU advisory and Oracle Support (My Oracle Support) to identify the exact patch set applicable to your EBS release in the 12.2.3-12.2.15 range. If immediate patching is not feasible, restrict HTTP access to the Oracle EBS Contracts Integration Internal Operations endpoints using perimeter firewall rules or network segmentation, allowing access only from trusted application and user networks - this directly addresses the AV:N attack vector and limits the pool of potential attackers. Additionally, enable Oracle EBS audit trail logging on contract records to detect unauthorized modifications during the window before patching. Note that network restriction may disrupt legitimate system-to-system integrations relying on direct HTTP access to the affected component, so coordinate with application integration owners prior to implementation.