What is the CVSS score of CVE-2026-62519?

CVE-2026-62519 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Succession Planning CVE-2026-62519

EUVD-2026-47540 MEDIUM

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-g2w4-mjfp-3vj9

Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable via HTTP, low complexity, requires only a standard authenticated EBS session (PR:L), no user interaction, with limited and equal partial impact across all three pillars and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Succession planning. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Succession planning accessible data as well as unauthorized read access to a subset of Oracle Succession planning accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Succession planning. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle E-Business Suite (EBS) is a comprehensive enterprise resource planning suite; the Succession Planning module is an HR functional area managing workforce continuity workflows. The affected component spans versions 12.2.3 through 12.2.15, a broad range covering several years of EBS 12.2.x releases. No CWE has been assigned by Oracle or NVD, so the precise root cause class - whether improper authorization, insufficient input validation, or another control failure - cannot be confirmed from available data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates the flaw is reachable over the network via HTTP, requires only a low-privileged session (consistent with a standard EBS user login), and operates entirely within the unchanged scope of the Succession Planning application. The balanced C:L/I:L/A:L impact profile is consistent with an improper authorization or access control deficiency that does not fully expose or fully corrupt data.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle fixes cumulatively, so applying the July 2026 CPU to affected EBS 12.2.3-12.2.15 instances is the primary remediation. An exact patched sub-version number was not independently confirmed from the available references - consult the Oracle CPU patch advisory and My Oracle Support (MOS) for the specific patch ID applicable to your EBS release. As a compensating control where immediate patching is not feasible, consider restricting access to the Succession Planning module to only HR personnel who require it through Oracle EBS function security and menu exclusions, which limits the attacker population. Note that access restriction does not eliminate the vulnerability - it only reduces exposure.