CVE-2026-62525 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle E-Business Suite, specifically those using Oracle Quality, should be aware of this vulnerability. This vulnerability has a CVSS score of 6.3, indicating a medium severity level. The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Quality, potentially leading to unauthorized data access and partial DOS. Oracle Quality users should prioritize patching this vulnerability.

Technical summary

The vulnerability in Oracle Quality has a CVSS 3.1 Base Score of 6.3, with impacts on Confidentiality, Integrity, and Availability. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Quality, potentially leading to unauthorized data access and partial DOS. Successful attacks can result in unauthorized update, insert, or delete access to some Oracle Quality accessible data, unauthorized read access to a subset of Oracle Quality accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. The affected versions are 12.2.3 through 12.2.15.

Defensive priority

Medium priority should be given to patching this vulnerability, as it has a medium CVSS score and can be exploited by low-privileged attackers.

Recommended defensive actions

• Apply the security patch provided by Oracle as soon as possible.
• Review and update access controls to ensure that only authorized personnel have access to Oracle Quality.
• Monitor Oracle Quality logs for any suspicious activity.
• Consider implementing additional security measures, such as network segmentation or intrusion detection systems.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-21T22:19:07.503Z and was last modified on 2026-07-22T16:18:49.887Z. The NVD entry is currently 6.3 (Confidentiality, Integrity and Availability impacts). The vulnerability affects Oracle Quality, a component of Oracle E-Business Suite, with versions 12.2.3 through 12.2.15 being vulnerable. The CVSS 3.1 Base Score is 6.3, indicating a medium severity level. The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Quality, potentially leading to unauthorized data access and partial DOS. Evidence is limited to public CVE and NVD details.

Official resources