CVE-2026-62546
Oracle E-Business Suite’s Applications Framework (Web Utilities) is vulnerable in versions 12.2.8 through 12.2.15. A high‑privileged attacker who can reach the system over HTTP can exploit the flaw to take over the framework. The compromise can affect other Oracle products because the vulnerability changes the security scope.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Applications Framework component of Oracle E‑Business Suite, versions 12.2.8‑12.2.15, used by organizations running Oracle E‑Business Suite.
Real-world impact
If exploited, an attacker can gain full control of the Applications Framework, exposing all data and services that depend on it and potentially disrupting business operations.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be triggered over the network with low effort, requires high privileges, and leads to complete loss of confidentiality, integrity, and availability. The scope change indicates that the impact extends beyond the vulnerable component to other parts of the system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources