CVE-2026-62451 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process component of the Oracle E-Business Suite, specifically affecting versions 12.2.14 through 12.2.15. The flaw represents a significant security weakness that falls under CWE-284 Access Control Issues, where insufficient authorization checks allow malicious actors to escalate their privileges and gain unauthorized access to critical business data. The vulnerability operates at the internal operations level of the application, making it particularly dangerous as it targets core business processes rather than surface-level user interfaces.
The technical implementation of this weakness allows a low privileged attacker with network access via HTTP to exploit the system through a well-defined attack vector. This represents a classic case of insufficient authorization controls where proper access validation mechanisms have been bypassed or inadequately implemented. The CVSS 3.1 score of 8.1 indicates high severity, with both confidentiality and integrity impacts rated as high, demonstrating that successful exploitation could lead to complete data compromise and modification capabilities. The attack requires minimal complexity with low attack complexity and no user interaction required, making it highly dangerous in production environments where network exposure is common.
Operational impact of this vulnerability extends beyond simple data theft to include complete data manipulation capabilities that could severely disrupt business operations and supply chain processes. The affected Oracle Work in Process system manages critical manufacturing and operational workflows, meaning unauthorized modification or deletion of work orders, production schedules, or inventory data could cause significant financial loss and operational disruption. Data compromise affects not just individual records but potentially entire datasets within the application's scope, with attackers able to access all accessible data rather than being limited to specific tables or modules.
Organizations should implement immediate mitigations including network segmentation to limit access to Oracle Work in Process systems, enabling comprehensive monitoring and logging of all HTTP requests to identify potential exploitation attempts. The vulnerability aligns with ATT&CK technique T1078 Valid Accounts where attackers leverage legitimate credentials to perform unauthorized operations, though this particular weakness may allow privilege escalation without requiring valid account compromise. Additional protective measures should include implementing proper access controls, regularly reviewing user permissions, and ensuring all Oracle E-Business Suite components are updated to patched versions that address this specific authorization flaw.
The vulnerability demonstrates the critical importance of maintaining up-to-date security patches in enterprise applications, particularly those handling sensitive operational data. Organizations relying on Oracle Work in Process for manufacturing operations must prioritize immediate remediation efforts as the vulnerability exposes fundamental data integrity controls within their business systems. Implementation of network-based intrusion detection systems and application firewalls can provide additional defense-in-depth measures to detect and prevent exploitation attempts while regular security assessments should verify that proper access controls have been implemented throughout the Oracle E-Business Suite environment to prevent similar authorization bypass scenarios from occurring in other components.