What is the CVSS score of EUVD-2026-47510?

EUVD-2026-47510 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle EBS EUVD-2026-47510

| CVE-2026-62474 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3vxf-q28h-jr95

Privilege Escalation Denial Of Service Oracle Lease And Finance Management

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network HTTP access with low-privilege authentication, no interaction needed, and all impacts limited to partial - consistent with vendor-provided vector and description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Lease and Finance Management accessible data as well as unauthorized read access to a subset of Oracle Lease and Finance Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Lease and Finance Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Oracle Lease and Finance Management is a module within Oracle E-Business Suite (EBS), Oracle's flagship enterprise resource planning (ERP) platform. The affected component, Lease Authoring, handles the creation and management of lease contracts and financial instruments. EBS operates over HTTP and exposes its modules to authenticated users, with role-based access control governing functional areas. The CWE classification is not specified in available data, leaving the root cause class (e.g., authorization bypass, input validation flaw, SQL injection) unconfirmed. Based on the CVSS impact triad of C:L/I:L/A:L, the vulnerability likely involves insufficient authorization checks or improper input handling within the Lease Authoring workflow, permitting reads of restricted data subsets, unauthorized writes/inserts/deletes, and resource exhaustion sufficient to cause partial service degradation. Affected CPE is Oracle E-Business Suite 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative; administrators should apply the full CPU bundle rather than individual patches. An exact patched version number is not independently confirmed in the available data - consult the My Oracle Support portal for the specific patch ID applicable to your EBS 12.2.x release. As a compensating control prior to patching, restrict access to the Lease Authoring component by limiting the roles and responsibilities assigned to users who do not require it, reducing the population of accounts that could trigger the vulnerability. Additionally, ensure EBS is not directly exposed to untrusted networks; place it behind a WAF or network perimeter control that restricts HTTP access to authorized internal IP ranges. Note that role restriction reduces exposure but does not eliminate the flaw - patching remains the definitive fix.