CVE-2026-62445 affects Oracle Order Management versions 12.2.4 through 12.2.15 and involves a vulnerability in the Product Diagnostic Tools component. It enables a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data within Oracle Order Management. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Oracle's July 2026 Critical Patch Update advisory references multiple security patches across Oracle products but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are strongly advised to apply available patches promptly as per Oracle's general guidance.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Order Management, as well as unauthorized access to all accessible data in the system. This compromises the confidentiality and integrity of sensitive business data but does not impact system availability. The vulnerability requires low attack complexity and no user interaction, with an attacker needing only low privileges and network access via HTTP.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities in Oracle products. However, the advisory does not explicitly confirm patch availability or provide a specific fix for CVE-2026-62445. Organizations should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until a patch is confirmed, restrict network access to Oracle Order Management interfaces and apply compensating controls to limit exposure. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.