What is the CVSS score of CVE-2026-62513?

CVE-2026-62513 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of E Business Suite are affected by CVE-2026-62513?

A vulnerability in Oracle E-Business Suite's manufacturing compliance module enables attackers with standard network access to extract sensitive regulatory and operational data.

How to fix or mitigate CVE-2026-62513?

Within 24 hours, identify all Oracle E-Business Suite instances using the Process Manufacturing Regulatory Management module and assess your organization's exposure to manufacturing and regulatory data extraction. Within 7 days, deploy the July 2026 Critical Patch Update to all affected systems, or implement immediate network controls restricting module access to administrative users only. Within 30 days, validate that patching is complete across your environment, review access logs for unauthorized data access attempts, and verify no related Oracle systems were compromised.

E Business Suite CVE-2026-62513

EUVD-2026-47534 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hw42-9jh7-m6w3

Authentication Bypass Oracle E Business Suite

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:39 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Regulatory Management. While the vulnerability is in Oracle Process Manufacturing Regulatory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Process Manufacturing Regulatory Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Process Manufacturing Regulatory Management accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.