Description
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Public Sector Financials, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-07-21
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The issue is a low-privilege vulnerability in Oracle Public Sector Financials that can be triggered via an HTTP request. An attacker with minimal privileges and network access may influence the system to perform unauthorized updates, inserts, or deletes, and read restricted data. The weakness results from improper access control (CWE-284) and leads to confidentiality and integrity impacts.

Affected Systems

Oracle Public Sector Financials, part of Oracle E-Business Suite, Internal Operations component. Affected versions are 12.2.3 through 12.2.15. The vulnerability may also influence other products due to a scope change.

Risk and Exploitability

The CVSS v3.1 base score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires a low-privileged attacker, from a user other than the attacker. The attack path likely involves the attacker sending a crafted HTTP request to the vulnerable endpoint while exploiting the improper access control to elevate privileges.

Generated by OpenCVE AI on August 4, 2026 at 00:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the July 2026 CPU (see Oracle CPU alert)
  • Restrict HTTP access to the Internal Operations component using network segmentation or firewall rules
  • Enforce least‑privilege policies for users accessing Oracle Public Sector Financials and disable or limit HTTP‑based configuration interfaces

Generated by OpenCVE AI on August 4, 2026 at 00:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Read via Low‑Privilege HTTP Access in Oracle Public Sector Financials

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Read via Low‑Privilege HTTP Access in Oracle Public Sector Financials

Tue, 28 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Vulnerability Enabling Unauthorized Data Modification in Oracle Public Sector Financials

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Vulnerability Enabling Unauthorized Data Modification in Oracle Public Sector Financials

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Public Sector Financials, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle public Sector Financials
CPEs cpe:2.3:a:oracle:public_sector_financials:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle public Sector Financials
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Public Sector Financials
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T15:55:54.992Z

Reserved: 2026-07-14T14:54:48.734Z

Link: CVE-2026-62479

cve-icon Vulnrichment

Updated: 2026-07-22T15:55:50.652Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses