This vulnerability exists in the Internal Operations component of Oracle Public Sector Financials within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It permits an attacker with low privileges and network access over HTTP to compromise the system, resulting in potential full takeover of Oracle Public Sector Financials. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-62478 and is referenced in Oracle's July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to complete compromise of Oracle Public Sector Financials, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected application, potentially leading to unauthorized access and control over sensitive financial operations.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-62478. Customers should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. It is strongly recommended to remain on actively supported versions and apply Oracle security patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.