CVE-2026-62480 in Public Sector Financials
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle E-Business Suite's Public Sector Financials component, specifically in the Internal Operations module, affecting versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that can be exploited by low-privileged attackers with network access through HTTP protocols. The vulnerability's exploitability score of 6.5 on the CVSS 3.1 scale indicates a moderate to high risk level, particularly concerning confidentiality impacts as evidenced by the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
The technical nature of this vulnerability stems from inadequate access controls or authentication mechanisms within the Internal Operations component of Oracle Public Sector Financials. Attackers with minimal privileges can leverage network-based HTTP connections to gain unauthorized access to sensitive financial data and potentially achieve complete system compromise. This represents a critical flaw in Oracle's access control implementation where proper authorization checks fail to prevent unauthorized data access, allowing attackers to bypass normal security boundaries.
The operational impact of this vulnerability extends beyond simple data theft, as successful exploitation can lead to unauthorized access to critical financial information that may include sensitive government or organizational data. The confidentiality impact is rated as high (C:H) indicating that attackers could potentially access all accessible data within the Oracle Public Sector Financials environment. This threat scenario poses significant risks to financial integrity, regulatory compliance, and data protection for organizations using these specific Oracle E-Business Suite versions.
Organizations should implement immediate mitigation strategies including applying Oracle's security patches and updates, reviewing network access controls, and implementing additional monitoring for suspicious HTTP traffic patterns. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and credential access. Network segmentation, firewall rules, and strict access control policies should be enforced to limit exposure while permanent fixes are deployed. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in the broader Oracle E-Business Suite implementation.
The affected version range of 12.2.3-12.2.15 indicates this is a long-standing issue that has persisted across multiple releases, suggesting inadequate patching procedures or insufficient security testing during development cycles. Organizations should prioritize upgrading to supported versions and implement comprehensive security monitoring to detect exploitation attempts. Given the vulnerability's ability to grant access to all accessible data without requiring additional privileges, the potential for significant financial and operational damage makes this issue particularly concerning for public sector organizations handling sensitive financial information.