This vulnerability affects Oracle Lease and Finance Management versions 12.2.3 to 12.2.15, specifically in the Lease Authoring component. It allows an attacker with low privileges and network access via HTTP to compromise the system by unauthorized data manipulation (update, insert, delete) and unauthorized read access to some data. Additionally, it can cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. The vendor strongly recommends applying available patches promptly.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data within Oracle Lease and Finance Management. It also allows an attacker to cause a partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability but at a low level for each, resulting in an overall medium severity rating (CVSS 6.3).

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-62474, Oracle recommends that customers remain on actively-supported versions and apply security patches without delay. Users of Oracle Lease and Finance Management should monitor the vendor advisory for patch availability and apply updates promptly once confirmed.