CVE-2026-62490

Analyzed Analyzed - Analysis Complete

Oracle Contracts Integration Information Disclosure

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-62490

EUVD

EUVD-2026-47522

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	e-business_suite	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Contracts Integration within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access via HTTP could exploit it to gain unauthorized access to critical data or full access to all accessible data in Oracle Contracts Integration.

Detection Guidance

Detection of CVE-2026-62490 requires checking for vulnerable versions of Oracle Contracts Integration (12.2.3-12.2.15) and monitoring HTTP network traffic for unauthorized access attempts to the component. Review Oracle E-Business Suite logs for suspicious activity targeting the Internal Operations module. Ensure all HTTP endpoints related to Oracle Contracts Integration are properly secured and not exposed to low-privileged attackers.

Impact Analysis

An attacker could steal sensitive data or gain full access to Oracle Contracts Integration data. This may lead to data breaches, financial loss, or reputational damage depending on the data stored.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or regulatory actions.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the Contracts Integration component (versions 12.2.3-12.2.15). Restrict network access to HTTP interfaces handling Oracle Contracts Integration. Review and enforce least-privilege access controls for users with access to this component.

Hi! I’m here to help you understand CVE-2026-62490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70