CVE-2026-62479 affects Oracle Public Sector Financials component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation requires user interaction from a person other than the attacker and can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 score of 5.4. The vulnerability may also impact additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch or remediation level for this vulnerability. The product is not a cloud service, so remediation depends on applying patches provided by Oracle.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some data within Oracle Public Sector Financials. This compromises data confidentiality and integrity. The vulnerability requires user interaction and low privilege network access via HTTP. There is no impact on availability. The vulnerability may also affect other Oracle products due to scope change.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Since this is not a cloud service, customers must apply patches manually once available. Until a patch is confirmed, monitor Oracle advisories for updates.