CVE-2026-62478 is an easily exploitable vulnerability in Oracle Public Sector Financials version 12.2.3 that permits a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can result in complete takeover of Oracle Public Sector Financials. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported as of the advisory date.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle Public Sector Financials, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and disruption of financial operations managed by the product.

Oracle has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities across its product portfolio. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply the relevant patches promptly. Since the vendor advisory does not explicitly confirm the patch status for CVE-2026-62478, users should verify patch availability and installation instructions from Oracle's official security alerts page. Maintaining up-to-date patched versions is critical to mitigate this vulnerability.