CVE-2026-62470

Analyzed Analyzed - Analysis Complete

Oracle Self-Service HR Unauthorized Data Access

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Manager Self-Service). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-62470

EUVD

EUVD-2026-47507

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	self-service_human_resources	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Self-Service Human Resources within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The issue allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all accessible data in the Oracle Self-Service Human Resources component.

Detection Guidance

Detection requires checking for vulnerable versions of Oracle Self-Service Human Resources (12.2.3-12.2.15). Review Oracle E-Business Suite logs for unauthorized HTTP access to the Manager Self-Service component. Ensure all instances are updated beyond 12.2.15.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive employee or HR-related data stored in the Oracle Self-Service Human Resources system. This may include personal information, payroll details, or other confidential records, potentially leading to data breaches or misuse of information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected Oracle E-Business Suite versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the Self-Service Human Resources component. Restrict network access to the HTTP interface to trusted sources only. Review and enforce strong authentication for low-privileged users. Monitor logs for unusual access patterns to the Oracle Self-Service Human Resources interface.

Hi! I’m here to help you understand CVE-2026-62470. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70