Oracle Advanced Planning Command Center CVE-2026-62515

Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the Advanced Planning Command Center Internal Operations component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the high-privilege prerequisite - this is not a pre-authentication or unauthenticated flaw despite the 'Authentication Bypass' submitter tag, which contradicts the PR:H vector. Affected deployments are Oracle E-Business Suite 12.2.3-12.2.15 running the APCC module; environments not running Advanced Planning Command Center are not exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) describes a network-reachable, low-complexity attack requiring high privileges and no user interaction, yielding high confidentiality impact, low integrity impact, and no availability impact - score 7.6. The dominant limiting factor is PR:H: the attacker must already hold high privileges within the EBS environment, which substantially narrows the realistic threat population to insiders or attackers who have already compromised a privileged account. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. A notable conflict exists between the 'Authentication Bypass' tag and PR:H - these are contradictory, and the CVSS vector (Oracle-authored) should take precedence; verify with Oracle CPU July 2026 notes. Net priority: real but moderate - a high-privilege prerequisite tempers the 7.6 score, though the scope change means blast radius could extend beyond APCC.

An attacker who has obtained a high-privileged EBS account - for example a malicious insider or an adversary who previously compromised a privileged operator - sends crafted HTTP requests to the Advanced Planning Command Center Internal Operations component. Leveraging the scope-change flaw, they read all APCC-accessible data and make limited unauthorized inserts, updates, or deletes, potentially reaching data belonging to other integrated EBS products. No public POC is known, and the low attack complexity means exploitation is straightforward once the privilege prerequisite is met.