What is the CVSS score of CVE-2026-62493?

CVE-2026-62493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Purchasing are affected by CVE-2026-62493?

Oracle E-Business Suite Purchasing module (versions 12.2.11-12.2.15) is vulnerable to system takeover by authenticated, low-privilege network users, with no public exploit identified at time of…

How to fix or mitigate CVE-2026-62493?

Within 24 hours: inventory all Oracle E-Business Suite instances running Purchasing versions 12.2.11 through 12.2.15; restrict module access to essential business users only; enable detailed audit logging on Purchasing transactions. Within 7 days: implement network segmentation restricting Purchasing module access to authorized subnets; deploy real-time monitoring for privilege escalation attempts and anomalous purchasing activity; audit and disable unnecessary user accounts with Purchasing module access. Within 30 days: monitor Oracle Critical Patch Updates for vendor-released patches; when available, evaluate and execute patching to bring affected systems out of the vulnerable version range; validate patch effectiveness in test environment before production deployment.

Oracle Purchasing CVE-2026-62493

EUVD-2026-47523 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-q586-x66w-xg4f

Privilege Escalation Oracle E Business Suite

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP access with authenticated low-privilege user (PR:L) and non-trivial preconditions (AC:H); full application takeover gives C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:42 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.

Technical ContextAI

Oracle Purchasing is a procurement module within Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise ERP platform typically fronted by Oracle HTTP Server and accessed over HTTP. The affected 'Internal Operations' component handles procurement workflow processing. Oracle did not assign a CWE (listed N/A) and does not publish root-cause detail in Critical Patch Update advisories, so the exact defect class is not specified; the C:H/I:H/A:H 'takeover' outcome combined with an authenticated network vector is consistent with an authorization/logic flaw or injection reachable by an authenticated EBS user, but this is inferred, not confirmed.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update for July 2026 (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS fixes as CPU patch bundles applied on top of the 12.2 release, so identify and apply the specific Purchasing/EBS patch for your installed 12.2.11-12.2.15 level rather than a standalone version bump. No exact standalone fixed version number is published in the input, so consult the CPU patch matrix for the correct patch ID. As compensating controls until patching, restrict network access to the EBS Purchasing/Internal Operations endpoints to trusted internal segments and VPN users only (reduces the AV:N reachability, at the cost of blocking remote/partner self-service access), tighten EBS user provisioning so few accounts hold Purchasing responsibilities (raising the PR:L barrier), and increase monitoring of authenticated Purchasing transactions for anomalous activity. These are stopgaps, not substitutes for the CPU patch.