What is the CVSS score of EUVD-2026-47545?

EUVD-2026-47545 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle HCM Configuration Workbench EUVD-2026-47545

| CVE-2026-62528 MEDIUM

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-2vr9-rgv6-6m6q

Denial Of Service SQLi Oracle Human Capital Management Configuration Workbench

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network HTTP access with low-privilege auth required; all three CIA impacts are partial and contained to the component, consistent with unauthorized data access and partial DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HCM Configuration Workbench accessible data as well as unauthorized read access to a subset of Oracle HCM Configuration Workbench accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Configuration Workbench. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle HCM Configuration Workbench is the Human Capital Management configuration and deployment tooling embedded within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform. The affected component is specifically labeled 'Install,' indicating it likely handles configuration provisioning or setup operations within the HCM module. Affected versions span 12.2.3 through 12.2.15 as confirmed by both Oracle's CPU July 2026 advisory and EUVD-2026-47545. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates the attack surface is HTTP-accessible, requires no complexity in the attack chain, and demands only low-privileged credentials - consistent with a flaw in an authenticated application endpoint that fails to properly authorize or validate input. No CWE classification was provided, so the precise root cause class (e.g., improper authorization, SQL injection, IDOR) cannot be confirmed from available intelligence.

RemediationAI

Apply the patches distributed in Oracle's Critical Patch Update for July 2026, available via the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version is not independently confirmed beyond the CPU advisory - consult Oracle's patch set documentation for the precise patch identifier applicable to your EBS 12.2.x installation. As a compensating control prior to patching, restrict HTTP access to the HCM Configuration Workbench Install component at the network or application tier (e.g., via Oracle EBS function security, firewall ACLs, or reverse proxy path filtering), which reduces exposure but may disrupt legitimate administrative workflows. Additionally, audit and minimize the set of low-privileged accounts with access to HCM configuration endpoints to reduce the attacker pool. Note that scope restriction at the network layer does not eliminate insider exploitation risk.