CVE-2026-62483 in Project Contracts
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Project Contracts accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Contracts, a component of the Oracle E-Business Suite that manages project contract operations and financial tracking. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this flaw has persisted across multiple updates. The vulnerability is classified as easily exploitable, meaning that attackers can leverage it with minimal technical sophistication or resources, which significantly amplifies its threat potential.
The technical nature of this vulnerability stems from insufficient access controls within the Internal Operations component of Project Contracts. An attacker with low privilege level and network access via HTTP can exploit this weakness to gain unauthorized modification capabilities. This represents a critical integrity violation where adversaries can perform unauthorized update, insert, or delete operations on sensitive project contract data. The CVSS 3.1 scoring system rates this vulnerability at 4.3 with a base score that reflects the integrity impact, indicating moderate severity but significant operational risk.
The operational impact of this vulnerability extends beyond simple data modification as it fundamentally compromises the integrity of project financial tracking and contractual agreements. When an attacker successfully exploits this weakness, they can alter project budgets, modify contract terms, or manipulate financial records without detection, potentially leading to substantial financial losses and compliance violations. The fact that this requires only low privilege access means that insider threats or compromised user accounts pose significant risks to organizational security.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques including T1078 (Valid Accounts) and T1566 (Phishing) for initial access, followed by T1070 (Indicator Removal on Host) and T1531 (Account Access Removal) for maintaining persistence and covering tracks. Organizations should implement immediate mitigations including network segmentation to limit HTTP access points, enhanced monitoring of Project Contracts data modifications, and mandatory privilege reviews. The recommended approach involves applying Oracle's security patches promptly while implementing additional controls such as web application firewalls, comprehensive audit logging, and regular security assessments to detect unauthorized access attempts and ensure data integrity across the affected Oracle E-Business Suite environment.