What is the CVSS score of CVE-2026-62489?

CVE-2026-62489 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62489

EUVD-2026-47521 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x7p6-qrr5-jv3j

Authentication Bypass Oracle E Business Suite

4.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Network vector confirmed; AC:H reflects vendor-stated difficulty; PR:L for required low-privileged account; no availability impact described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.

Technical ContextAI

Oracle Contracts Integration is a module within the Oracle E-Business Suite (EBS), an enterprise resource planning platform widely used in manufacturing, finance, and procurement. The affected component is Internal Operations, which governs contract lifecycle management data flows. The CWE is not assigned by NVD, but the vendor tag of 'Authentication Bypass' suggests the root cause is an improper authorization or access-control enforcement failure - a class of flaw (related to CWE-284/CWE-285) where a lower-trust principal can invoke operations or access data scoped to a higher-trust role. The vulnerability is reached over HTTP (AV:N), implying exposure through the EBS web application layer. Affected CPE covers Oracle E-Business Suite versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU releases cumulative patches, so administrators should apply the full July 2026 patch set for their specific EBS 12.2.x release. An exact patched version number was not independently confirmed beyond the CPU reference - consult Oracle My Oracle Support for the specific patch ID applicable to your EBS version. While patching is prioritized, compensating controls for environments that cannot immediately patch include restricting network access to the EBS web application layer to trusted internal networks or VPN, enforcing the principle of least privilege to minimize the number of accounts with any EBS access, and auditing Oracle EBS access control lists for the Contracts Integration module to detect anomalous access patterns. Restricting HTTP access at the perimeter reduces exposure given the AV:N attack vector, though it does not eliminate risk from insider or low-privileged attacker scenarios.