Oracle Yard Management CVE-2026-62496

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a valid low-privileged EBS account (CVSS PR:L) with the ability to reach the Yard Management Internal Operations component - it is not anonymous/unauthenticated. Limiting factors: the attacker must first obtain any authenticated EBS session, and only EBS 12.2.6 through 12.2.15 deployments running the Yard Management module are affected; environments that do not expose the EBS web interface to the attacker or that do not deploy Yard Management are not exploitable. No user interaction, no high privileges, and no non-default configuration toggle are documented as required beyond having the affected module present.

The signals converge on a genuine priority for organizations running Oracle EBS. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding total application takeover - Oracle itself flags it as 'easily exploitable.' The single low-privilege requirement (PR:L) is the main gating factor: an attacker needs some valid EBS foothold, which limits fully anonymous internet exploitation but is a low bar in environments with many application users. No EPSS score, POC, or KEV entry is present in the provided data, so there is no evidence of active exploitation or published exploit code at this time; the risk is currently driven by severity and exploitability rather than observed in-the-wild activity. Note the tags list 'Information Disclosure,' yet the description and vector describe full CIA takeover - treat the vector as authoritative and the tag as incomplete. CWE is unassigned, so root-cause-based mitigation reasoning is limited.

An attacker who holds or obtains a low-privileged Oracle EBS application account sends crafted HTTP requests to the Yard Management Internal Operations interface and abuses the flaw to escalate to full control of the module, reading and altering yard/logistics data and disrupting operations. No user interaction or high privileges are needed, and the attack complexity is low; no public POC is currently available.