What is the CVSS score of CVE-2026-62527?

CVE-2026-62527 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Learning Management CVE-2026-62527

EUVD-2026-47544 MEDIUM

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-hj44-626j-fxwv

Denial Of Service SQLi Oracle Learning Management

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network access over HTTP with a valid low-privileged account required; partial C/I/A impacts reflect bounded LMS data manipulation with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Learning Management accessible data as well as unauthorized read access to a subset of Oracle Learning Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Learning Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning suite; Oracle Learning Management (OLM) is the sub-module responsible for employee training, course catalogs, certifications, and learner records. The vulnerable component is Import and Export, which typically handles bulk ingestion and extraction of LMS data (course definitions, learner progress, completion records). No CWE identifier is provided, so the root cause class cannot be confirmed; however, given the partial CIA impact profile (C:L/I:L/A:L) and the nature of import/export functionality, the flaw may involve improper authorization enforcement on data operations - permitting a low-privileged user to access or modify records beyond their intended scope. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-47544.

RemediationAI

Apply the patches distributed as part of Oracle's Critical Patch Update for July 2026, available through My Oracle Support and documented at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed from the available data beyond the CPU advisory reference - consult the patch matrix in the advisory for the specific patch identifier applicable to your EBS 12.2.x installation. As a compensating control while patching, restrict access to the Oracle Learning Management Import and Export component to only those roles that operationally require it, using Oracle EBS function security and menu exclusions to remove the component from lower-privileged user responsibilities. Additionally, ensure Oracle EBS application tier access is confined to internal networks or VPN, reducing the exposed attack surface to authenticated internal users only. Note that function security restrictions may limit import/export workflows for legitimate users, so assess operational impact before applying.