What is the CVSS score of CVE-2026-62546?

CVE-2026-62546 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62546?

Oracle E-Business Suite versions 12.2.8 through 12.2.15 contain a critical vulnerability in the Web Utilities component that allows high-privileged attackers with HTTP network access to achieve…

How to fix or mitigate CVE-2026-62546?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.8 through 12.2.15 and prioritize business-critical instances for remediation. Within 7 days, complete risk assessment of network exposure and access controls to determine exploitation likelihood, and coordinate with system teams to schedule maintenance windows for patch deployment. Within 30 days, apply the Oracle E-Business Suite July 2026 Critical Patch Update to all affected systems; systems running versions outside this range are unaffected and do not require patching for this CVE.

Oracle E-Business Suite CVE-2026-62546

EUVD-2026-47549 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h45q-f2rp-2rf6

Oracle Authentication Bypass Applications Framework

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network HTTP vector with low complexity but a required high-privilege EBS account (PR:H); scope change (S:C) because impact crosses into other EBS products, with full C/I/A takeover.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:35 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. While the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Applications Framework (OAF) is the Java/J2EE presentation and business-logic layer that renders and drives the self-service web pages of Oracle E-Business Suite; the affected 'Web Utilities' subcomponent handles server-side web helper functionality exposed over HTTP. Because OAF is a shared runtime underpinning many EBS modules, a flaw here inherits a scope change (CVSS S:C), meaning exploitation of the framework crosses a trust/authorization boundary and affects other products running on the same platform. No CWE was assigned in the input, so the precise root-cause class (e.g., improper authorization or injection) cannot be stated from the available data; Oracle's tags label it as Information Disclosure, though the CVSS C:H/I:H/A:H and 'takeover' language indicate impact well beyond disclosure alone.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this issue (Patch available per vendor advisory: Oracle CPU July 2026, https://www.oracle.com/security-alerts/cpujul2026.html); no single standalone fix version is specified in the input beyond the CPU bundle, so consult that advisory for the exact patch set for your 12.2.x release. Because exploitation requires high privileges over HTTP, effective compensating controls until patching include tightly restricting and auditing high-privilege EBS accounts, limiting network reachability of the EBS web tier to trusted networks or VPN (blocking direct internet exposure of OAF endpoints), and placing a WAF/reverse proxy in front of the self-service application to constrain access to Web Utilities URLs - with the trade-off that overly aggressive URL filtering can break legitimate self-service functionality and should be validated in a non-production environment first.