This vulnerability affects Oracle Contracts Integration versions 12.2.3 through 12.2.15 and allows an unauthenticated attacker with network access via HTTP to exploit the system, requiring user interaction from a third party. The attack can result in unauthorized modification (update, insert, delete) and partial unauthorized read access to Oracle Contracts Integration data. The vulnerability has a CVSS 3.1 score of 6.1, reflecting medium severity with low confidentiality and integrity impacts and no availability impact. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Contracts Integration. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm the patch status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized update, insert, or delete operations on Oracle Contracts Integration accessible data, as well as unauthorized read access to a subset of that data. This compromises data confidentiality and integrity within the affected Oracle Contracts Integration product and potentially other Oracle products due to scope change. There is no reported impact on availability. The attack requires network access via HTTP and user interaction from a person other than the attacker.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including those affecting Oracle products. However, the specific patch status for CVE-2026-62444 is not explicitly stated in the advisory. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should be aware that the vulnerability requires user interaction and network access via HTTP. No vendor advisory states that no action is required or that the vulnerability is already mitigated.