What is the CVSS score of CVE-2026-62542?

CVE-2026-62542 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Advanced Benefits CVE-2026-62542

EUVD-2026-47548 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fgx3-x79r-95px

Authentication Bypass Denial Of Service Oracle Advanced Benefits

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor vector is consistent with description: network HTTP access, low privilege account required, no interaction needed, partial impact across C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Benefits accessible data as well as unauthorized read access to a subset of Oracle Advanced Benefits accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Benefits. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefits component) is achievable by low-privileged, network-authenticated attackers over HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected, spanning a broad range of Oracle EBS deployments. Oracle classifies this as 'easily exploitable' in the July 2026 CPU; no public exploit identified at time of analysis and not listed in CISA KEV, but the low attack complexity and no user interaction requirement elevate realistic risk for organizations with internal threat actors or compromised credentials.

Technical ContextAI

Oracle Advanced Benefits is a module within Oracle E-Business Suite (EBS) that manages employee benefit enrollment, election, and administration through a web-based Self Service Benefits interface exposed over HTTP. The vulnerability resides specifically in this Self Service Benefits component, accessible to low-privileged EBS users via standard network HTTP requests. No CWE classification was provided by Oracle, which limits precise root-cause categorization; however, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U with C:L/I:L/A:L impacts) is consistent with an improper authorization or access control deficiency-a class of flaw where application-layer authorization checks fail to enforce data isolation between users of similar privilege levels. The partial impact across all three security pillars (confidentiality, integrity, availability) suggests the vulnerability touches benefit enrollment data read/write paths and potentially a resource or processing endpoint that can be partially disrupted.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-62542. The exact patched build version must be confirmed directly from the CPU advisory documentation, as no specific fixed version number was included in the available intelligence. Patch available per vendor advisory. As a compensating control prior to patching, restrict network access to Oracle EBS Self Service Benefits interfaces to trusted internal network segments or VPN-only access, reducing exposure to only users who are already authenticated to the corporate network-note this does not eliminate the insider threat vector but raises the bar for external attackers. Additionally, audit and reduce the number of low-privileged accounts with access to the Self Service Benefits component, applying principle of least privilege to limit the attacker population. Enable and review Oracle EBS application-level audit logging for the Self Service Benefits component to detect anomalous cross-user data access or modification patterns as a detective control.