CVE-2026-62479 in Public Sector Financials
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Public Sector Financials, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Public Sector Financials, a component of the broader Oracle E-Business Suite ecosystem, specifically within the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure where organizations utilizing these releases remained susceptible to exploitation. The vulnerability's classification as easily exploitable suggests that attackers require minimal technical expertise to leverage this weakness effectively.
The attack vector requires network access via HTTP and targets low privileged users who can initiate malicious requests against the system. This accessibility through standard web protocols makes the vulnerability particularly concerning as it can be exploited from external networks without requiring specialized tools or extensive reconnaissance. The necessity for human interaction from a person other than the attacker introduces a social engineering element to the exploitation process, potentially involving user deception or manipulation techniques.
The security impact extends beyond the immediate Oracle Public Sector Financials component through what is termed scope change, meaning that successful exploitation can affect additional products within the Oracle E-Business Suite ecosystem. This cascading effect amplifies the potential damage and complicates remediation efforts as organizations must consider broader system implications when addressing this vulnerability.
From a technical impact perspective, the vulnerability enables unauthorized modification capabilities including update, insert, and delete operations against specific data within Oracle Public Sector Financials. Additionally, attackers can gain unauthorized read access to subsets of accessible data, creating both confidentiality and integrity risks. The CVSS 3.1 base score of 5.4 reflects these combined impacts with a moderate severity classification that balances the accessibility of the vulnerability against its potential damage.
The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) provides specific insights into the vulnerability characteristics, showing network accessibility with low attack complexity, requiring low privilege levels, necessitating user interaction, and demonstrating a changed scope that affects additional products. The confidentiality and integrity impacts are rated as low severity but remain significant given the financial nature of the data involved.
This vulnerability aligns with CWE-284 (Improper Access Control) and potentially CWE-352 (Cross-Site Request Forgery) depending on implementation details, representing a fundamental access control weakness that allows unauthorized data manipulation. The ATT&CK framework would categorize this under privilege escalation techniques where attackers leverage insufficient access controls to gain expanded capabilities.
Organizations should prioritize immediate remediation through Oracle's security patches and updates for affected versions, while implementing network segmentation to limit exposure. Additional mitigations include enhanced monitoring of HTTP traffic for suspicious patterns, user education regarding social engineering risks, and regular security assessments to identify similar access control weaknesses across the broader Oracle E-Business Suite deployment. The scope change aspect necessitates comprehensive impact analysis to understand how other integrated Oracle products might be affected by exploitation of this vulnerability.