This vulnerability affects Oracle Self-Service Human Resources versions 12.2.3 to 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the application, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly mention a patch or remediation for this specific vulnerability, but Oracle advises customers to apply available patches promptly to mitigate risks. No exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Self-Service Human Resources. The confidentiality of sensitive information is compromised, but there is no impact on data integrity or system availability. The vulnerability requires network access and low privileges, making it relatively easy to exploit if the attacker has access to the network.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-62470. Customers should review the advisory and apply any relevant patches provided by Oracle for Oracle Self-Service Human Resources versions 12.2.3 through 12.2.15 as soon as they become available. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Until an official patch is confirmed, monitor Oracle's security advisories for updates.