What is the CVSS score of CVE-2026-62490?

CVE-2026-62490 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Contracts Integration CVE-2026-62490

EUVD-2026-47522 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-m5xf-c94h-cjg6

Authentication Bypass Oracle Information Disclosure E Business Suite

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network HTTP access with low-privilege auth (PR:L) and non-trivial exploitation conditions (AC:H); impact is confidentiality-only with no integrity or availability effects and unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.

Technical ContextAI

Oracle Contracts Integration is an enterprise module within Oracle E-Business Suite (EBS) responsible for managing contract lifecycle operations. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting a flaw in the application's internal authorization enforcement layer - likely an improper access control or broken object-level authorization issue (analogous to CWE-285 or CWE-639, though no CWE has been formally assigned). No CPE strings were supplied in the intelligence data; affected scope is defined by Oracle as versions 12.2.3 through 12.2.15. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates HTTP-based network exploitation requiring low-level credentials and specific, non-trivial attack conditions - consistent with a privilege escalation within the application tier rather than a perimeter-level authentication bypass.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026 as the primary remediation, available via the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle EBS customers should consult My Oracle Support for the specific patch ID applicable to their installed version within the 12.2.3-12.2.15 range. The exact patched release version has not been independently confirmed beyond the July 2026 CPU release. As an interim compensating control where immediate patching is not feasible, restrict HTTP network access to the Oracle Contracts Integration Internal Operations component to only trusted internal network segments and enforce the principle of least privilege by auditing and reducing the user accounts that hold any level of access to this component - note that over-restriction may interrupt legitimate contract operations workflows and should be validated in a staging environment first. Organizations should also enable Oracle EBS audit logging on the Internal Operations component to detect anomalous data access patterns during the patching window.