This vulnerability affects Oracle HRMS (UK) within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is a difficult to exploit vulnerability that requires network access via HTTPS and low privileges but can lead to significant compromise, including unauthorized creation, deletion, or modification of critical data. The vulnerability also affects the confidentiality and integrity of data with a CVSS 3.1 score of 8.2. The vulnerability has a scope change, meaning it may impact additional Oracle products beyond Oracle HRMS (UK). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm the availability of a patch for this specific CVE. Customers are strongly advised to apply all relevant patches from the Critical Patch Update promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle HRMS (UK) and potentially other Oracle products due to scope change. The confidentiality and integrity of all accessible data in Oracle HRMS (UK) can be compromised. The vulnerability does not impact availability. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and scope change with high confidentiality and integrity impact.

Oracle has released a Critical Patch Update advisory in July 2026 that includes multiple security patches across various products. Although the advisory does not explicitly confirm a patch for CVE-2026-62456, customers should review the July 2026 Critical Patch Update documentation and apply all relevant patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. Patch status is not yet confirmed explicitly for this CVE; therefore, check the vendor advisory for current remediation guidance.