What is the CVSS score of CVE-2026-62487?

CVE-2026-62487 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62487

EUVD-2026-47519 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-21 secalert_us@oracle.com

GHSA-7jrw-j746-qxgm

CSRF Oracle E Business Suite

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Vendor-provided vector confirmed: network-accessible, unauthenticated, user-interaction required, scope change; low C/I and no availability impact align with description.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle Contracts Integration is a subcomponent of Oracle E-Business Suite (OeBS), Oracle's flagship Java EE-based enterprise resource planning platform delivered over HTTP/HTTPS. The affected release range is 12.2.3 through 12.2.15, covering several years of supported OeBS releases. No CPE string was provided in available intelligence, but the EUVD entry EUVD-2026-47519 and Oracle's July 2026 CPU advisory corroborate the version bounds. The CWE field is listed as N/A in NVD data; however, the CVSS vector characteristics - network attack vector, no privileges required, mandatory user interaction, and scope change (S:C) - are strongly consistent with a web-based injection class such as reflected XSS or a similar client-side injection flaw in the Internal Operations component. The 'Authentication Bypass' tag reported in intelligence metadata suggests the vulnerability may additionally allow circumventing access control checks within an active user session context, though the mechanism is not elaborated in available descriptions.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-62487. Oracle bundles patches into CPU releases rather than individual patch version increments, so the remediation path is applying the full July 2026 CPU to the affected Oracle E-Business Suite 12.2.x installation - an exact standalone patched release number is not independently confirmed from available references. As a compensating control prior to patching, restrict network access to Oracle EBS and specifically the Internal Operations component to trusted internal subnets only, using firewall or load-balancer rules to prevent unauthenticated external HTTP access; note this may disrupt any legitimate externally-facing EBS workflows. Additionally, conduct user awareness training targeting active EBS users to reduce susceptibility to phishing attacks that deliver the UI:R trigger, though this does not eliminate the underlying vulnerability.