What is the CVSS score of CVE-2026-62495?

CVE-2026-62495 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Process Manufacturing are affected by CVE-2026-62495?

Oracle Process Manufacturing Process Execution 12.2.15 is vulnerable to complete module compromise by authenticated users, creating direct risk to manufacturing operations, supply chain visibility,…

How to fix or mitigate CVE-2026-62495?

Within 24 hours: Inventory all systems running Oracle Process Manufacturing Process Execution 12.2.15; assess the number of low-privileged authenticated users with access to the module. Within 7 days: Apply Oracle's July 2026 Critical Patch Update to all affected instances and validate the patch in non-production environments before production deployment. Within 30 days: Perform functional validation of Process Manufacturing workflows post-patch, review authentication and access logs for the vulnerability window for any suspicious activity, and confirm patch deployment across the environment.

Oracle Process Manufacturing CVE-2026-62495

EUVD-2026-47525 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2v9h-rvwx-cq9w

Authentication Bypass Oracle E Business Suite

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachable (AV:N) but Oracle labels it 'difficult to exploit' (AC:H) and it needs a valid low-privileged EBS account (PR:L); full takeover justifies C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:41 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Process Execution product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Process Execution. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Process Execution. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The affected component is Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform, specifically the Process Manufacturing (OPM) Process Execution module used to manage batch/recipe-based production for industries such as chemicals, food, and pharmaceuticals. The vulnerable surface is reached over HTTP through the EBS application tier (Oracle Application Server / WebLogic front end), and the flaw sits in the 'Internal Operations' subcomponent. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., injection, broken access control, or deserialization) cannot be stated with confidence from the available data; Oracle's vendor tag of 'Information Disclosure' is inconsistent with the C:H/I:H/A:H 'takeover' impact described and should be treated cautiously. No CPE string was provided in the intelligence set; the affected product is identified only by Oracle/EUVD product-and-version naming (12.2.15).

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and recommended remediation; consult that CPU risk matrix for the exact EBS 12.2 patch numbers applicable to your release level, as Oracle publishes fixes as CPU patches rather than a single tagged version. Because exploitation requires network HTTP access and a low-privileged account, effective compensating controls until patching are to restrict access to the EBS application tier and the Process Manufacturing/Internal Operations URLs behind a VPN or reverse-proxy allowlist (trade-off: may block legitimate remote users and integrations), tighten and audit EBS user provisioning to minimize low-privilege accounts and enforce strong authentication/MFA on the EBS login (trade-off: operational friction for large user bases), and monitor EBS application and web-tier logs for anomalous OPM Process Execution activity. Do not rely on the vendor 'Information Disclosure' tag to scope mitigations narrowly, since the CVSS vector claims full takeover.