What is the CVSS score of CVE-2026-62496?

CVE-2026-62496 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Yard Management are affected by CVE-2026-62496?

Oracle Yard Management (Oracle E-Business Suite versions 12.2.6-12.2.15) can be fully compromised by authenticated network users with low-level privileges, enabling complete operational system…

How to fix or mitigate CVE-2026-62496?

Within 24 hours, inventory all systems running Oracle Yard Management versions 12.2.6-12.2.15 and map network exposure. Within 7 days, implement network segmentation restricting Yard Management access to administrative networks only, enforce IP whitelisting, disable unnecessary external connectivity, and require multi-factor authentication for all Yard Management user accounts. Within 30 days, escalate to Oracle support requesting emergency patch status or interim mitigations specific to your environment, and begin evaluation of upgrade options to versions outside the 12.2.6-12.2.15 range.

Oracle Yard Management CVE-2026-62496

EUVD-2026-47526 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-59r9-fj7c-w8x6

Privilege Escalation Oracle Yard Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no user interaction, but a valid low-privileged EBS account is required (PR:L); full takeover gives high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:40 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Yard Management is a logistics/warehouse-yard module delivered within the Oracle E-Business Suite (EBS) 12.2 application stack, running on the EBS middle tier (Oracle Application Server / WebLogic and mod_pl/sql-style web entry points) and backed by the Oracle Database. The affected Internal Operations component is reached over HTTP through the EBS web interface, which is the standard exposure surface for authenticated EBS users. No CWE was assigned by the source (CWE: N/A), so the precise root-cause class is not documented; the CVSS profile (unchanged scope, full CIA impact, low privilege) is consistent with an authenticated injection or access-control/logic flaw that lets an ordinary application account escalate to control of the module rather than a memory-safety bug. Exact affected builds are the EBS 12.2.6-12.2.15 release train.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); an exact standalone fix version is not enumerated in the provided data, so treat this as 'Patch available per vendor advisory' and apply the CPU patch set corresponding to your EBS 12.2.x level. Because exploitation requires an authenticated low-privilege account, compensating controls until patching is complete include restricting network reachability of the EBS web tier and the Yard Management endpoints to trusted internal networks/VPN rather than the public internet, tightening EBS responsibility/role assignments so ordinary users cannot reach Internal Operations functions, and increasing monitoring of Yard Management HTTP activity and privileged transactions; the trade-off is that access restrictions may disrupt remote or partner users who legitimately use the module. Do not rely on WAF signatures alone given no published exploit or CWE to base rules on.