CVE-2026-62487 in Contracts Integration
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Contracts Integration, a component of the Oracle E-Business Suite ecosystem that handles contract management and integration processes. The affected versions span from 12.2.3 through 12.2.15, representing a significant release range that suggests this flaw has persisted across multiple maintenance cycles. The vulnerability's classification as easily exploitable indicates that attackers can leverage it without requiring specialized skills or extensive preparation, making it particularly concerning for organizations running these legacy systems.
The technical nature of this vulnerability involves an authentication bypass mechanism that operates over HTTP protocols, allowing unauthenticated attackers to gain access to the Oracle Contracts Integration system. This represents a fundamental security failure in the application's access control mechanisms, where proper authentication checks are either missing or inadequately implemented. The CVSS 3.1 scoring of 6.1 reflects the moderate severity level, with confidentiality and integrity impacts rated as low, though the scope change aspect indicates potential for broader system compromise.
Network-based attacks can be executed by remote adversaries who simply need to establish HTTP connections to the target system without requiring any prior authentication credentials. The requirement for human interaction from users other than the attacker suggests that exploitation may involve social engineering elements or require specific user actions to complete the attack vector, though this does not mitigate the underlying vulnerability. This characteristic places additional burden on organizations to monitor user behavior and maintain awareness of potential coordinated attacks.
The operational impact of successful exploitation extends beyond the immediate Oracle Contracts Integration component, as evidenced by the scope change indicator in the CVSS vector. Attackers can achieve unauthorized update, insert, or delete operations against sensitive contract data, potentially corrupting critical business information. Additionally, read access to subsets of accessible data allows for information disclosure that could compromise business relationships, financial terms, and contractual obligations. The integrity impact suggests that attackers could modify contract terms or conditions, potentially leading to significant financial and legal consequences.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle Contracts Integration systems, deployment of web application firewalls to monitor and filter HTTP traffic, and enforcement of strong access controls through proper authentication mechanisms. The vulnerability's presence across multiple versions indicates the need for comprehensive patch management strategies, though organizations may need to consider migration planning to newer Oracle E-Business Suite releases that address these architectural weaknesses. This vulnerability aligns with CWE-287 (Improper Authentication) and potentially CWE-312 (Cleartext Storage of Sensitive Information) while mapping to ATT&CK techniques involving credential access and data extraction through network-based attacks.