Oracle Production Scheduling CVE-2026-62518

The attacker must have network HTTP access to the Oracle E-Business Suite application tier and must hold valid low-privilege credentials (CVSS PR:L) - this is authenticated exploitation, not remote-unauthenticated. Only Oracle Production Scheduling versions 12.2.3 through 12.2.15 are affected, and the vulnerable code path is the Internal Operations component of that module, so environments not running Production Scheduling are not exposed. Limiting factors: the required authenticated account and reachability of the internal EBS web tier meaningfully constrain who can exploit this; no user interaction is required (UI:N), so once an attacker has any qualifying account the attack complexity is low (AC:L).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, score 7.6) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with the weight coming from high integrity impact - meaning the realistic threat is an authenticated insider or a compromised low-privilege account tampering with scheduling/critical data. Counterbalancing signals point to lower urgency: the vulnerability is not in CISA KEV (no confirmed active exploitation), no POC or public exploit is identified in the provided data, and no EPSS score was supplied to gauge exploitation probability. The PR:L requirement is a meaningful limiter - an attacker must already hold valid EBS credentials - so this is a real but not drop-everything priority. Note the input contains no independent SSVC or EPSS data, so exploitation-probability judgments here are inferred from the CVSS vector and the absence of KEV/POC signals rather than confirmed.

A user holding a low-privilege Oracle E-Business Suite account (or an attacker who has phished or reused such credentials) sends crafted HTTP requests to the Production Scheduling Internal Operations functions and, exploiting the flaw, modifies or deletes critical scheduling data outside their authorization and degrades the module's availability. No user interaction or elevated privileges are needed. No public POC or exploit code is identified at time of analysis.