Oracle E-Business Suite CVE-2026-62546

Exploitation requires the attacker to already hold high privileges (PR:H) within Oracle E-Business Suite and network access to the OAF Web Utilities component over HTTP; attack complexity is low and no user interaction is needed once those privileges are held. The key limiting factors are the high-privilege prerequisite - this is not exploitable by an anonymous or low-privileged remote user - and applicability only to EBS releases 12.2.8 through 12.2.15. Realistic risk is therefore concentrated in scenarios of insider abuse or escalation from a previously compromised privileged account, and the scope change means success impacts additional EBS products beyond the framework itself.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) drives the 9.1 score primarily through the scope change and triple-high impact, but the PR:H requirement is the decisive limiting factor: the attacker must already hold high privileges within the EBS environment, which sharply narrows the realistic attacker population to insiders or those who have already gained privileged access. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active or automatable exploitation - this reads as a high-impact-but-privilege-gated issue rather than a mass-exploited remote pre-auth flaw. Note a mild tension worth verifying with Oracle: the 'Information Disclosure' tag conflicts with the C:H/I:H/A:H 'takeover' impact, and Oracle's high scores often reflect worst-case scope-change accounting rather than trivially reachable impact. Prioritize patching for internet-exposed or multi-tenant EBS instances, but the PR:H gate means this is not a drop-everything unauthenticated emergency.

An attacker who has already obtained a high-privileged EBS account (for example a compromised functional administrator or a malicious insider) sends crafted HTTP requests to the Oracle Applications Framework Web Utilities component and abuses the flaw to take over the framework. Because of the scope change, that foothold extends into other EBS products sharing the platform, yielding full confidentiality, integrity, and availability compromise. No public proof-of-concept was identified at time of analysis.