This vulnerability affects Oracle Project Contracts component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product by performing unauthorized update, insert, or delete actions on accessible data. The CVSS 3.1 base score is 4.3, reflecting a medium severity primarily due to integrity impact without confidentiality or availability impact. The vulnerability is documented as CVE-2026-62483. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly detail patch status for this vulnerability. Customers are urged to apply available patches from Oracle's CPU to address this and other vulnerabilities.

Successful exploitation allows unauthorized modification (update, insert, delete) of some data accessible through Oracle Project Contracts, impacting data integrity. There is no impact on confidentiality or availability. The attacker requires network access via HTTP and low privileges. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory strongly recommends applying the latest security patches without delay. Although the advisory does not explicitly confirm a patch for CVE-2026-62483, it is part of the cumulative security updates released. Users of Oracle Project Contracts versions 12.2.3 through 12.2.15 should verify patch availability in the July 2026 CPU documentation and apply relevant patches promptly to mitigate this vulnerability. Patch status is not yet confirmed explicitly; check the vendor advisory for current remediation guidance.