What is the CVSS score of CVE-2026-62518?

CVE-2026-62518 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Production Scheduling are affected by CVE-2026-62518?

Oracle Production Scheduling (Oracle E-Business Suite, versions 12.2.3-12.2.15) contains a vulnerability enabling attackers to create, delete, or modify critical operational data and trigger partial…

How to fix or mitigate CVE-2026-62518?

Within 24 hours, identify all Oracle E-Business Suite instances running affected versions of Production Scheduling and restrict network access to this module to essential administrative accounts only. Over the next 7 days, implement enhanced audit logging on all data modification events within Production Scheduling, enforce strict least-privilege access controls, and isolate the affected module via network segmentation if feasible. Within 30 days, monitor Oracle security advisories for patch availability, document this dependency for remediation prioritization in your patch management cycle, and coordinate directly with Oracle on expected fix timelines; establish temporary acceptance of risk and detective controls as your interim posture until patching is available.

Oracle Production Scheduling CVE-2026-62518

EUVD-2026-47539 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-xchh-7hgf-w3cx

Denial Of Service Oracle Information Disclosure E Business Suite

7.6

CVSS 3.1 · NVD

Severity by source

Vendor (oracle) PRIMARY

HIGH

qualitative

NVD

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

7.6 HIGH

Network-reachable HTTP function needing valid low-privilege credentials (PR:L) and no interaction; weighted to high integrity with limited confidentiality and partial availability impact, matching the described data-tampering and partial DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:37 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.6

DescriptionNVD

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Production Scheduling. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).

AnalysisAI

Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.

Technical ContextAI

Oracle Production Scheduling is a supply-chain planning module delivered as part of Oracle E-Business Suite (EBS), the flaw sitting in its Internal Operations component. EBS is a large Java/PL-SQL web application stack fronted by Oracle HTTP Server and accessed over HTTP, so the vulnerable surface is an authenticated application function reachable across the network. Oracle's advisory does not assign a CWE (CWE: N/A), and the description provides no root-cause detail; the CVSS profile (low privileges, no user interaction, high integrity with lower confidentiality and availability impact) is consistent with a broken-access-control or injection-style flaw that lets an authenticated user act on data beyond their intended authorization. Exact internal mechanics are not disclosed in the available data.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle addresses EBS 12.2.x flaws through the quarterly CPU patch set rather than a single named point release, so patch to the CPU-corresponding level for your 12.2.3-12.2.15 installation (Patch available per vendor advisory - no standalone fix version is stated in the available data, so confirm the exact patch number for your release against the CPU matrix). Until patched, compensating controls should focus on the PR:L prerequisite: tighten Production Scheduling/EBS role and responsibility assignments so low-privilege accounts cannot reach Internal Operations functions, restrict network access to the EBS application tier to trusted internal segments and VPN, and increase auditing/monitoring of scheduling data changes to detect unauthorized create/delete/modify activity. Trade-off: restricting responsibilities or network reachability can disrupt legitimate planning users, so validate role scoping in a test environment before enforcing.