Oracle Quality CVE-2026-62525

Exploitation requires a valid, authenticated low-privileged user account within the Oracle E-Business Suite environment (CVSS PR:L confirmed). Network access to the EBS application server over HTTP is required (CVSS AV:N). No user interaction from a victim is required (CVSS UI:N). No non-default configuration is specified as a prerequisite; any EBS 12.2.3-12.2.15 deployment with the Oracle Quality module active is in scope. The primary limiting factor is authenticated access - unauthenticated external attackers cannot exploit this without first obtaining EBS credentials. Impact is confined to the Quality module's data scope and does not affect other EBS components or the underlying OS (CVSS S:U).

The CVSS 3.1 base score of 6.3 reflects a medium-severity, network-accessible vulnerability requiring only low privileges (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), with partial impacts across all three CIA pillars. This is consistent with a logged-in EBS user exploiting weak authorization in a web endpoint to exceed their intended access. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, placing real-world exploitation risk at moderate-low for most organizations. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. The low attack complexity and absence of user interaction requirements mean that, once authenticated access is obtained, exploitation would be straightforward. The partial denial-of-service potential is an additional concern for availability-sensitive production ERP environments. The primary limiting factor is the requirement for a valid low-privileged account within the EBS environment, which constrains the attacker pool to insiders or previously compromised EBS credentials.

An attacker with a low-privileged Oracle EBS account - such as a standard internal user or a compromised service account - sends crafted HTTP requests to endpoints within the Quality Workbench HTML system component. The requests exploit insufficient authorization checks to read, modify, or delete Quality module data beyond the user's intended access, and may also degrade service availability for other users of the Quality module.