Oracle Customer Care CVE-2026-62607

Exploitation requires a high-privileged Oracle EBS user account with network access to the EBS application tier via HTTP. The vulnerability is within the 'Internal Operations' subcomponent of Customer Care, meaning the attacker must be able to authenticate to the application and reach this component - non-default network segmentation (e.g., EBS application tier not exposed externally) substantially limits the remote attack surface. The 'Authentication Bypass' tag suggests that once initial high-privileged authentication is achieved, certain downstream authorization checks within the component can be circumvented, allowing access beyond what the account's intended permissions allow. Exploitation is limited by: (1) requirement for a high-privileged EBS credential - opportunistic unauthenticated exploitation is not consistent with the PR:H vector; (2) the EBS application tier must be network-reachable by the attacker; (3) only versions 12.2.3-12.2.15 are affected. The tension between the PR:H CVSS metric and the 'Authentication Bypass' tag means that if the bypass allows privilege escalation from lower access levels, the real exploitation bar may be lower than the official CVSS vector indicates.

The CVSS 3.1 score of 8.7 is well-supported by the vector components: network-reachable (AV:N), low complexity (AC:L), no user interaction (UI:N), and a scope change (S:C) that amplifies impact across the EBS platform. PR:H is the primary limiting factor and the most important defender signal - exploitation requires a high-privileged account within EBS, which constrains opportunistic attacks but does not eliminate insider-threat or credential-compromise scenarios. The 'Authentication Bypass' tag creates a notable tension with PR:H: if authentication is truly bypassed, the effective privilege requirement may be lower than Oracle's official vector implies. This inconsistency should be clarified with Oracle. EPSS data was not provided in the intelligence set; given the PR:H constraint and enterprise-only deployment model, real-world exploitation probability is likely low-to-moderate despite the high CVSS score. No CISA KEV listing and no public exploit code further support treating this as a serious-but-not-emergency patching priority unless credential compromise is already suspected in the environment.

An attacker who has compromised a high-privileged Oracle EBS account - through phishing, credential stuffing, or insider access - authenticates to the EBS web tier over HTTP and sends crafted requests to the Internal Operations component of Customer Care. By exploiting the authorization bypass, the attacker reads and exfiltrates the full Customer Care dataset (customer PII, service history, account details) and makes unauthorized modifications to records, then pivots via the scope change to affect downstream EBS modules. No public exploit code or proof-of-concept is identified at time of analysis.