What is the CVSS score of CVE-2026-62548?

CVE-2026-62548 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62548?

CVE-2026-62548 in Oracle E-Business Suite HRMS (US) module (versions 12.2.3-12.2.15) permits authenticated high-privileged attackers to achieve complete system compromise with full impact to employee…

How to fix or mitigate CVE-2026-62548?

Within 24 hours, identify all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and confirm HRMS (US) module deployment status. Within 7 days, apply the Oracle E-Business Suite July 2026 Critical Patch Update to all affected production systems. Within 30 days, validate patch deployment across all environments (dev, test, production), review administrative access logs for the past 90 days for any suspicious HRMS activity, and request patch confirmation from your Oracle support team.

Oracle E-Business Suite CVE-2026-62548

EUVD-2026-47551 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-9cgc-mm6v-6r89

Privilege Escalation Oracle Human Resources Management System

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable app tier gives AV:N/AC:L/UI:N; takeover requires existing high application privilege so PR:H; full module takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:34 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large web-based enterprise resource planning suite; the affected piece is the Human Resources Management System (HRMS) US localization, specifically its Internal Operations component. EBS is a multi-tier application (Oracle database plus an application/middle tier serving self-service HTML and Forms content over HTTP), so the 'network access via HTTP' vector points to the web-facing application tier rather than direct database access. Because CWE is listed as N/A by Oracle (their advisories historically omit weakness classification), the precise root-cause class cannot be confirmed from the provided data; the Oracle tag 'Information Disclosure' and the C:H/I:H/A:H impact together suggest an authorization or input-handling flaw in an HRMS Internal Operations function that a legitimately privileged user can abuse to escalate to full module takeover. No CPE strings were supplied, so exact affected component identifiers cannot be enumerated beyond Oracle's stated version range.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as CPU patches per version rather than as a single named build, so identify and apply the specific CPU patch for your EBS 12.2.x release from that advisory - Patch available per vendor advisory, exact patched build not independently named in the provided data. Because the vulnerability requires high application privileges, effective compensating controls until patching include tightly restricting and auditing the set of users granted HRMS (US) Internal Operations responsibilities, enforcing least privilege on EBS accounts, and monitoring privileged HRMS activity; place the EBS application tier behind a VPN or restrict HTTP access to trusted internal networks to reduce reachability. The trade-off of restricting responsibilities is potential disruption to legitimate HR operations, and network restrictions may impede remote self-service users, so validate against business workflows before enforcing.