Description
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Quality accessible data as well as unauthorized read access to a subset of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Published: 2026-07-21
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Oracle Quality Workbench HTML system allows a low‑privileged attacker with network access to the HTTP interface to perform unauthorized updates, inserts, deletes, and reads of Oracle Quality data. The vulnerability also permits the attacker to trigger a partial denial of service, affecting confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability impacts Oracle Corporation’s Oracle Quality component of Oracle E‑Business Suite for versions 12.2.3 through 12.2.15. These deployments expose an HTTP endpoint that does not enforce adequate privilege verification when handling data modification requests.

Risk and Exploitability

The CVSS 3.1 base score of 6.3 indicates moderate severity, with modest effects on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP request from a low‑privileged source, requiring only network connectivity to the exposed Quality Workbench service and no elevated privileges.

Generated by OpenCVE AI on August 4, 2026 at 00:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 patch for the affected Oracle Quality product
  • Restrict HTTP access to the Quality Workbench to trusted internal networks or specific IP ranges via firewall rules
  • Enforce strict role‑based access controls to limit user privileges on the Quality Workbench

Generated by OpenCVE AI on August 4, 2026 at 00:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Partial DoS via Low‑Privilege HTTP Access in Oracle Quality Workbench

Thu, 30 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Partial DoS via Low‑Privilege HTTP Access in Oracle Quality Workbench

Tue, 28 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Partial Denial of Service via HTTP in Oracle Quality

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Partial Denial of Service via HTTP in Oracle Quality

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-269
CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Quality accessible data as well as unauthorized read access to a subset of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
First Time appeared Oracle
Oracle quality
CPEs cpe:2.3:a:oracle:quality:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle quality
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Oracle Quality
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T15:15:28.255Z

Reserved: 2026-07-14T14:54:48.739Z

Link: CVE-2026-62525

cve-icon Vulnrichment

Updated: 2026-07-22T15:15:20.864Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control