What is the CVSS score of CVE-2026-62488?

CVE-2026-62488 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62488

EUVD-2026-47520 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g5qr-47fp-6299

Authentication Bypass Oracle E Business Suite

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP interface requires low-privileged credentials; high integrity impact from unauthorized contract data manipulation; no confidentiality or availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Contracts Integration is a procurement and contract lifecycle management module within Oracle E-Business Suite (EBS), Oracle's enterprise ERP platform. The vulnerability resides in the Internal Operations component, which handles internal workflow and data operations for contract management. The CWE is not provided by Oracle, but the 'Authentication Bypass' tag combined with PR:L in the CVSS vector strongly suggests an improper authorization flaw (likely CWE-285 or CWE-862 - Improper Authorization or Missing Authorization) rather than a credential bypass: an already-authenticated low-privileged user can invoke operations in the Internal Operations component that should be restricted to higher-privileged roles. Affected versions span Oracle EBS 12.2.3 through 12.2.15 per EUVD-2026-47520. No CPE strings are included in available data, but the affected product family is Oracle E-Business Suite release 12.2.x.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The specific patched release version is not independently confirmed in available data - consult the CPU advisory directly to identify the exact patch bundle for Oracle E-Business Suite 12.2.x. As a compensating control pending patching, restrict network access to the Oracle Contracts Integration Internal Operations component at the application or network layer, limiting HTTP access to trusted internal IP ranges only; this reduces the attack surface without eliminating it, since internal users with low-privileged credentials remain a risk. Additionally, audit and tighten role-based access controls within Oracle EBS for the Contracts Integration module, removing low-privileged accounts that do not require access to Internal Operations workflows. Monitor application logs for anomalous contract creation, deletion, or modification events by low-privileged user accounts as a detection control.