What is the CVSS score of CVE-2026-62563?

CVE-2026-62563 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle Work in Process CVE-2026-62563

EUVD-2026-47559 MEDIUM

Improper Authorization (CWE-285)

2026-07-21 secalert_us@oracle.com

GHSA-597h-9gj7-c524

Authentication Bypass Oracle Work In Process

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory low-privilege EBS account; UI:R for required victim interaction; S:C captures cross-module EBS impact; no availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:01 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Work in Process accessible data as well as unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.

Technical ContextAI

Oracle Work in Process (WIP) is a manufacturing execution module within Oracle E-Business Suite (EBS), responsible for managing production orders, work orders, and shop floor operations. The vulnerability resides specifically in the Internal Operations sub-component, accessible via HTTP, consistent with EBS's standard web-tier architecture using Oracle Application Framework (OAF). The CVSS vector AV:N/AC:L confirms the component is reachable from the network with low attack complexity, characteristic of EBS self-service or internal portal endpoints. The scope change (S:C) is architecturally significant: within EBS, shared session context and data models mean a compromise in WIP can propagate read/write impact to adjacent modules such as Oracle Inventory or Order Management. The 'Authentication Bypass' tag supplied by the reporter suggests an authorization control deficiency - likely privilege escalation within the application layer rather than a bypass of the EBS login mechanism, since PR:L confirms the attacker must already hold a valid low-privilege EBS account. No CWE classification was assigned, preventing precise root cause categorization, but the symptom profile is consistent with improper authorization (CWE-285) or missing function-level access control.

RemediationAI

The primary remediation is to apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs deliver cumulative patches, and administrators should consult the CPU documentation to identify the specific patch set number applicable to their 12.2.x release within the 12.2.5-12.2.15 range; an exact fixed release version is not independently confirmed in the available source data beyond the CPU advisory reference. As a compensating control pending patch application, restrict network-level HTTP access to the EBS application tier so that only trusted internal clients or VPN-connected users can reach the Work in Process Internal Operations component - this raises the bar for low-privilege attackers who may otherwise access EBS from broader network segments. Additionally, audit and minimize the number of active low-privilege EBS accounts, as PR:L is a hard prerequisite for exploitation; disabling dormant accounts reduces the available attack surface. Note that network restriction does not eliminate the vulnerability if insiders or VPN-connected users are the threat model, so patch application remains the definitive fix.