Description
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A operations component of Oracle Work in Process allows a low‑privileged attacker with network access over HTTP to create, delete or modify critical data. The vulnerability results in unauthorized creation, deletion or alteration of data and full access to all data that the product can reach. This is an authorization bypass weakness (CWE‑284) that directly threatens confidentiality and integrity of enterprise data.

Affected Systems

Oracle Corporation’s Oracle Work in Process product is affected. Oracle E‑Business Suite versions 12.2.14 and 12.2.15 contain the vulnerability. The flaw exists in the internal operations component of the Work in Process service.

Risk and Exploitability

The CVSS 3.1 base score of 8.1 denotes an impact on confidentiality and integrity. The EPSS score of < 1% indicates a low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only network access to the HTTP interface and low user privileges, making it a relatively easy attack path for an attacker with network visibility.

Generated by OpenCVE AI on August 4, 2026 at 00:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle Work in Process security patch released in the July 2026 update
  • Restrict or remove HTTP exposure to the Oracle Work in Process service if not required for business processes
  • Enforce strict role‑based access controls to ensure users have only the permissions needed for their responsibilities

Generated by OpenCVE AI on August 4, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Oracle Work in Process Authorization Bypass Enabling Unauthorized Data Modification

Sun, 02 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Oracle Work in Process Internal Operations

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Oracle Work in Process Internal Operations

Tue, 28 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Work in Process Enabling Unauthorized Data Access

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Work in Process Enabling Unauthorized Data Access

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Work in Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle work In Process
CPEs cpe:2.3:a:oracle:work_in_process:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle work In Process
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Work In Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T17:25:53.743Z

Reserved: 2026-07-14T14:54:48.732Z

Link: CVE-2026-62451

cve-icon Vulnrichment

Updated: 2026-07-22T17:25:48.715Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses