Oracle E-Business Suite CVE-2026-62548

Exploitation requires the attacker to already hold a high-privileged account within Oracle E-Business Suite HRMS (US) that can reach the Internal Operations component over HTTP (CVSS PR:H), and the target must be running an affected release in the 12.2.3-12.2.15 range. What limits exploitation: the PR:H requirement means an anonymous or low-privileged user cannot exploit this - the attacker needs existing privileged access to the HRMS application, which confines the realistic threat to insiders or attackers who have already compromised privileged credentials. No user interaction is required (UI:N) and no special non-default feature toggle is named in the description, so among privileged users the barrier is low.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The most important limiting signal is PR:H: exploitation requires the attacker to already hold high privileges within the application, which materially narrows the realistic threat to insiders or an attacker who has already compromised a privileged EBS account, rather than an anonymous internet attacker. Offsetting that, AC:L and UI:N mean that once those privileges are held the attack is low-complexity and fully automatable, and the triple-high impact means the payoff is complete module takeover. No EPSS score, SSVC decision, KEV listing, or POC was provided; absence of these is not evidence of safety, but there is currently no signal of active or imminent exploitation. Net: a genuine High-severity issue that should be patched in the normal Oracle CPU cycle, but the PR:H prerequisite makes mass, unauthenticated exploitation unlikely - prioritize based on how many privileged HRMS users your deployment exposes.

An attacker who already holds a high-privileged HRMS (US) account - for example a malicious insider or an actor who phished a privileged HR administrator's credentials - sends crafted HTTP requests to the Internal Operations functionality of the EBS application tier. Because the attack is low-complexity and requires no user interaction, the attacker escalates to full takeover of the HRMS (US) module, reading and altering sensitive HR data and disrupting availability. No public exploit code has been identified at time of analysis.