PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62472 Oracle Corporation CVE debrief

A vulnerability exists in Oracle Installed Base, a component of Oracle E-Business Suite. The affected versions are 12.2.4 through 12.2.15. This vulnerability is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Installed Base accessible data, as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. The vulnerability has a high severity level with a CVSS 3.1 Base Score of 8.1.

Vendor
Oracle Corporation
Product
Oracle Installed Base
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Organizations using Oracle E-Business Suite, specifically versions 12.2.4 through 12.2.15, should be aware of this vulnerability and take necessary actions to protect their systems. The vulnerability impacts both confidentiality and integrity, and attackers can exploit it over the network with low privileges. Oracle E-Business Suite operators, platform administrators, vulnerability management teams, and security teams should prioritize patching and mitigation efforts.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 8.1, indicating a high severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), showing that the vulnerability can be exploited over the network with low privileges, and it impacts both confidentiality and integrity. The vulnerability exists in Oracle Installed Base, a component of Oracle E-Business Suite, affecting versions 12.2.4 through 12.2.15. The vulnerability allows an attacker to compromise Oracle Installed Base, leading to unauthorized creation, deletion, or modification access to critical data or all Oracle Installed Base accessible data.

Defensive priority

High

Recommended defensive actions

  • Apply the security patch provided by Oracle as soon as possible.
  • Restrict network access to the Oracle Installed Base component.
  • Monitor for suspicious activity related to Oracle Installed Base.
  • Review and update access controls to ensure that only authorized users have access to critical data.
  • Perform a thorough review of the affected Oracle E-Business Suite deployments to identify potential exposure.
  • Consider implementing compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-21T22:19:03.557Z and was last modified on 2026-07-22T17:16:57.353Z. The NVD entry is currently in the 'Received' status. The vulnerability affects Oracle Installed Base, a component of Oracle E-Business Suite, with versions 12.2.4 through 12.2.15 being vulnerable. The CVE record was sourced from nvd_modified. The NVD entry provides additional details on the vulnerability. The CVE record has not been modified since its publication.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:19:03.557Z and has not been modified since then. The NVD entry is currently Received.