CVE-2026-62458

Received Received - Intake

Denial of Service in Oracle Work in Process

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Work in Process as well as unauthorized update, insert or delete access to some of Oracle Work in Process accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-62458

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	work_in_process	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Work in Process within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access via HTTP can exploit it to cause a denial of service (hang or crash) or gain unauthorized access to modify data in Oracle Work in Process.

Detection Guidance

Since this is an Oracle Work in Process vulnerability, detection involves checking for unusual network traffic or system behavior related to Oracle HTTP services. Monitor logs for repeated crashes or hangs in the Oracle Work in Process component. Check for unauthorized data modifications in the Oracle Work in Process database tables.

Impact Analysis

The vulnerability can lead to system downtime due to crashes or hangs, disrupting business operations. It may also allow attackers to alter or delete data in Oracle Work in Process, potentially causing data integrity issues or loss.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite. Restrict network access to the Oracle Work in Process component via HTTP. Implement strong authentication and authorization controls for low-privileged users. Monitor for suspicious activity and disable the component if under active attack.

Hi! I’m here to help you understand CVE-2026-62458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70