This vulnerability affects the Oracle Public Sector Payroll component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of Oracle Public Sector Payroll, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the payroll system, potentially leading to unauthorized access to sensitive payroll data and disruption of payroll operations.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities. However, the vendor advisory does not explicitly confirm patch availability for CVE-2026-62476. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Public Sector Payroll systems and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.