This vulnerability affects Oracle Public Sector Financials versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Public Sector Financials. The confidentiality of sensitive information is at high risk, but the vulnerability does not affect data integrity or availability. No known exploits in the wild have been reported to date.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities including this one. However, the advisory does not explicitly confirm a patch or remediation level for CVE-2026-62480. Organizations should monitor Oracle's official security alerts for patch availability and apply updates as soon as they are released. Until a patch is confirmed, restrict network access to the affected Oracle Public Sector Financials instances where possible.