CVE-2026-62563 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Work in Process accessible data as well as unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process component of the Oracle E-Business Suite, specifically affecting versions 12.2.5 through 12.2.15. The flaw represents a medium-severity security weakness classified under CWE-284 Access Control Issues, where insufficient authorization checks permit low-privileged attackers to exploit the system through HTTP network connections. The vulnerability's exploitability requires minimal technical sophistication as indicated by CVSS vector AV:N/AC:L/PR:L, meaning attackers can leverage network access with only low privileges and low complexity. However, successful exploitation demands human interaction from users other than the attacker, suggesting that social engineering or user manipulation plays a critical role in execution.
The operational impact of this vulnerability extends beyond the immediate Oracle Work in Process component through scope change effects that can compromise additional products within the Oracle E-Business Suite ecosystem. Attackers can achieve unauthorized data modifications including updates, inserts, and deletions of sensitive information stored within Oracle Work in Process accessible data repositories. Additionally, the vulnerability enables unauthorized read access to specific subsets of data, potentially exposing confidential operational information. The CVSS base score of 5.4 reflects the moderate impact on both confidentiality and integrity aspects of the system, with no direct availability impact noted in the vector assessment.
From an attack perspective, this vulnerability aligns with ATT&CK technique T1210 Exploitation of Remote Services, where attackers leverage network-accessible services to gain unauthorized access to business-critical applications. The requirement for human interaction indicates potential vectors such as phishing attacks or malicious links that could trick legitimate users into performing actions that trigger the vulnerability. Organizations should consider implementing network segmentation controls and monitoring for anomalous HTTP traffic patterns that might indicate exploitation attempts. Security teams should also establish user behavior analytics to detect unusual data access patterns that could signal unauthorized modifications within Oracle Work in Process systems.
The vulnerability's classification under CWE-284 emphasizes the fundamental flaw in access control mechanisms that fail to properly validate user permissions before granting system operations. This represents a common pattern in enterprise applications where insufficient input validation and authorization checks create pathways for privilege escalation attacks. Organizations operating affected versions should prioritize patch management activities, as Oracle typically releases quarterly security updates containing fixes for such vulnerabilities. The scope change aspect of this vulnerability highlights the interconnected nature of Oracle E-Business Suite components, where compromise of one module can potentially affect multiple integrated systems within the enterprise architecture.
Mitigation strategies should include implementing strict access controls and monitoring user activities that involve data modification operations within Oracle Work in Process. Network-level protections such as web application firewalls and intrusion detection systems can help detect and prevent exploitation attempts. Regular security assessments should focus on identifying weak points in user authentication processes and ensuring proper privilege management across all Oracle E-Business Suite components. Additionally, comprehensive user training programs should address social engineering risks that could enable attackers to manipulate legitimate users into facilitating successful exploitation of this vulnerability.