This vulnerability affects Oracle Work in Process versions 12.2.14 and 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Work in Process. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with no impact on availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability or provide remediation details.

The vulnerability allows unauthorized access to critical data within Oracle Work in Process, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on system availability. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit if the system is exposed.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches for Oracle products. Customers are strongly advised to remain on actively supported versions and apply security patches promptly. However, the specific patch status for CVE-2026-62451 is not explicitly stated in the advisory. Therefore, users should consult the Oracle advisory directly for the latest patch availability and installation instructions. Until a patch is confirmed, consider restricting network access to Oracle Work in Process HTTP interfaces to trusted users only.