Oracle Work in Process CVE-2026-62563

Exploitation requires the attacker to possess a valid Oracle E-Business Suite account with at minimum low-level privileges (PR:L); unauthenticated external actors cannot exploit this vulnerability directly. The target system must be running Oracle Work in Process versions 12.2.5 through 12.2.15 with the Internal Operations component active and accessible over HTTP. A critical additional prerequisite is human interaction from a person other than the attacker (UI:R) - a legitimate EBS user must be induced to perform a specific action (such as following a crafted URL or loading attacker-influenced content) for exploitation to succeed, which prevents fully automated or opportunistic attacks. Exploitation is bounded by: the requirement for a pre-existing low-privilege EBS credential, mandatory victim interaction, and the constrained data impact (read access to a subset of data; insert/update/delete to some WIP-accessible data only). The scope change does expand impact to additional EBS products but does not itself lower the exploitation prerequisites.

The CVSS 3.1 score of 5.4 (Medium) is proportionate given the constrained impact profile: low confidentiality and integrity impacts with no availability impact. The most significant risk amplifier is the scope change (S:C), which elevates the potential blast radius beyond the WIP module to other EBS components sharing the same application context. However, two key limiting factors substantially reduce real-world exploitation probability: first, PR:L mandates a valid low-privilege EBS account, eliminating unauthenticated external threat actors; second, UI:R requires a victim user to actively interact with attacker-controlled content (e.g., a crafted URL or in-application link), ruling out fully automated exploitation. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no reported POC code further indicate this is not currently being actively leveraged in the wild. For organizations running Oracle EBS in internet-facing or multi-tenant configurations, the risk is elevated relative to isolated intranet deployments due to the broader pool of potential low-privilege credential holders. The 'Authentication Bypass' tag and PR:L create a minor tension - if the flaw truly bypasses authentication, PR:N would be expected; this discrepancy is unresolved and should be verified against Oracle's CPU advisory documentation.

An attacker with a valid low-privilege Oracle EBS account crafts a malicious HTTP request or hyperlink targeting the Work in Process Internal Operations endpoint and delivers it to a more privileged EBS user through an in-application message, phishing email, or injected content. When the victim clicks the link or otherwise interacts with the attacker-controlled content, the authorization bypass is triggered, allowing the attacker to read restricted WIP data and perform unauthorized data modifications that may propagate to adjacent EBS modules due to the scope change. No public proof-of-concept code has been identified at time of analysis.