Oracle E-Business Suite CVE-2026-62534

Exploitation requires network HTTP access to the Oracle Applications Framework web tier and a valid low-privileged EBS account (CVSS PR:L) - it is authenticated, not fully anonymous - but needs no user interaction (UI:N) and has low attack complexity (AC:L). The affected deployment must be running Oracle E-Business Suite with Oracle Applications Framework on a supported release in the 12.2.11-12.2.15 range and expose the Web Utilities component. The primary limiting factor is the requirement for at least a low-privilege application credential; the primary risk amplifier is that EBS environments routinely provision many such low-privilege self-service accounts, and internet-facing EBS DMZ deployments make the OAF tier network-reachable to a wide user base.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a genuinely serious, low-complexity, network-reachable flaw requiring only a low-privileged account and no user interaction - a realistic priority for any internet- or intranet-exposed EBS deployment where many users hold low-level accounts. However, corroborating exploitation signals are absent: no EPSS score, KEV status, POC, or SSVC decision data was provided, so real-world exploitation probability cannot be quantified from the input. The single low prerequisite (PR:L) is the main gate - EBS environments typically have numerous low-privilege self-service users, so this barrier is weak in practice. Net: treat as high-priority patching driven by the CVSS profile and Oracle CPU inclusion, while noting that active-exploitation and probability data are missing rather than negative.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite self-service account authenticates to the OAF web tier and sends crafted HTTP requests to the vulnerable Web Utilities functionality, escalating to full control of the Applications Framework context. From there they can read or alter sensitive ERP/HR/financial data and disrupt availability. No public proof-of-concept was identified in the provided data.