What is the CVSS score of CVE-2026-62486?

CVE-2026-62486 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62486

EUVD-2026-47518 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-69rh-22f7-f2g3

Authentication Bypass Denial Of Service Oracle E Business Suite

5.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

5.0 MEDIUM

Oracle-provided vector accurately reflects network HTTP delivery, AC:H difficulty, no attacker auth, required victim interaction, and partial limited CIA impacts with no scope change.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Contracts Integration. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.

Technical ContextAI

Oracle E-Business Suite (EBS) 12.2.x is Oracle's integrated enterprise application suite, and the Contracts Integration component specifically handles contract lifecycle management and related internal operations within the EBS framework, exposed via HTTP over the standard EBS application server stack (typically Oracle Application Server or WebLogic). The vulnerability resides in the Internal Operations subcomponent, accessed over HTTP, suggesting a web-layer flaw in request handling or data processing logic. No CWE identifier is assigned by Oracle or NVD, leaving the root cause class (e.g., injection, CSRF, improper input validation) unconfirmed from available data. Affected versions span the EBS 12.2.3 through 12.2.15 release range - a broad surface covering multiple years of 12.2.x maintenance releases. Oracle identifies this as 'difficult to exploit,' consistent with the AC:H metric, possibly indicating a race condition, specific sequencing requirement, or environment-dependent precondition.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version number is not independently confirmed in available data beyond the CPU reference - consult Oracle's patch advisory and My Oracle Support for the specific patch set identifier applicable to your EBS version. As compensating controls while patching is staged: restrict network-level access to the Oracle EBS HTTP interface to trusted internal IP ranges using firewall or network ACLs, reducing the attack surface for the AV:N vector; implement web application firewall rules to detect anomalous HTTP traffic targeting Contracts Integration endpoints; and conduct end-user awareness efforts to reduce susceptibility to social engineering that could satisfy the UI:R condition. Note that network restriction may affect legitimate remote users of EBS and should be coordinated with business stakeholders.