CVE-2026-62474 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Lease and Finance Management versions 12.2.3-12.2.15 should prioritize patching this vulnerability to prevent potential exploitation. This involves reviewing system inventories, applying patches, and implementing compensating controls like network segmentation or access restrictions. Monitoring system logs for suspicious activity and conducting vulnerability scanning and penetration testing are also recommended to identify potential weaknesses and limit the attack surface.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Lease and Finance Management, potentially leading to unauthorized data access and partial denial of service. Successful attacks can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of service. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Lease and Finance Management. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Defensive priority

Medium-High due to potential for data access and partial denial of service. Organizations should prioritize patching and implement compensating controls to limit the attack surface. Monitoring system logs for suspicious activity is also recommended. Consider vulnerability scanning and penetration testing to identify potential weaknesses. The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Lease and Finance Management, potentially leading to unauthorized data access and partial denial of service. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Lease and Finance Management, potentially leading to unauthorized data access and partial denial of service. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Lease and Finance Management. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The CVE record was published on 2026-07-21T22:19:03.800Z and was last modified on 2026-07-22T17:16:57.570Z. The NVD entry is currently in the 'Received' status. Oracle has provided a security alert related to this vulnerability. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Lease and Finance Management. The CVSS 3.1 Base Score is 6.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Lease and Finance Management, potentially leading to unauthorized data access and partial denial of service. Successful attacks can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of service. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Lease and Finance Management. The vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity level. The CVSS Vector

Recommended defensive actions

• Apply the patch from Oracle as soon as possible
• Conduct a thorough inventory of Oracle Lease and Finance Management instances to identify affected systems
• Implement compensating controls, such as network segmentation or access restrictions, to limit the attack surface
• Monitor system logs for suspicious activity
• Consider vulnerability scanning and penetration testing to identify potential weaknesses

Evidence notes

The CVE record was published on 2026-07-21T22:19:03.800Z and was last modified on 2026-07-22T17:16:57.570Z. The NVD entry is currently in the 'Received' status. Oracle has provided a security alert related to this vulnerability. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Lease and Finance Management. The CVSS 3.1 Base Score is 6.3, indicating a medium severity level.

Official resources