What is the CVSS score of CVE-2026-62515?

CVE-2026-62515 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Advanced Planning Command Center are affected by CVE-2026-62515?

Oracle Advanced Planning Command Center (APCC) in E-Business Suite versions 12.2.3-12.2.15 contains a privilege escalation vulnerability (CVE-2026-62515, CVSS 7.6) allowing high-privileged internal…

How to fix or mitigate CVE-2026-62515?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 with APCC enabled, catalog all high-privilege user accounts with APCC access, and review access logs for anomalous activity. Within 7 days, implement network-level access controls restricting HTTP connections to APCC to authorized administrators only, enable comprehensive audit logging of all APCC data access and modification attempts, and review high-privilege account assignments to eliminate unnecessary access. Within 30 days, establish formal communication with Oracle regarding patch availability and timelines, conduct security testing to validate compensating control effectiveness, and develop contingency plans including potential system migration if vendor patch timeline exceeds organizational risk tolerance.

Oracle Advanced Planning Command Center CVE-2026-62515

EUVD-2026-47536 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-g2hh-h69g-fxff

Authentication Bypass Privilege Escalation Oracle E Business Suite

7.6

CVSS 3.1 · NVD

Severity by source

Vendor (oracle) PRIMARY

HIGH

qualitative

NVD

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Network HTTP reachable and low complexity, but requires an existing high-privileged EBS account (PR:H); scope change per cross-product impact, high confidentiality and low integrity, no availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:38 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.6

DescriptionNVD

Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Planning Command Center. While the vulnerability is in Oracle Advanced Planning Command Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Planning Command Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Planning Command Center accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.

Technical ContextAI

The affected component is Oracle Advanced Planning Command Center, a supply-chain planning module layered on Oracle E-Business Suite 12.2.x, reached over HTTP through the EBS web tier (Internal Operations). No CWE was assigned by NVD/Oracle, so the precise root-cause class is not formally categorized; the submitter tag references 'Authentication Bypass,' but this conflicts with the CVSS vector's PR:H (high privileges required), so the flaw more likely enables privilege/scope escalation from an existing high-privileged session rather than a true pre-auth bypass. The scope-change flag (S:C) indicates the vulnerable APCC component can affect resources managed by other EBS components or the shared database security authority, which is characteristic of tightly integrated EBS module trust relationships.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input does not specify an exact patched build number, so consult the CPU matrix for the precise APCC/EBS 12.2.x patch level to apply. As compensating controls until patching, tightly restrict and audit high-privileged EBS/APCC accounts (the exploitation prerequisite), enforce least privilege on Internal Operations roles, place the EBS web tier behind a VPN or IP-allowlist so HTTP access to APCC is not broadly reachable, and increase monitoring of privileged session activity for anomalous data access; the trade-off of network restriction is reduced accessibility for legitimate remote planners, and tightening privileged roles may require workflow review to avoid disrupting operational tasks.