This vulnerability affects Oracle Contracts Integration versions 12.2.3 to 12.2.15 and allows an unauthenticated attacker with network access via HTTP to compromise the product by unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 5.9, reflecting a medium severity with an attack vector of network, high attack complexity, no privileges required, and no user interaction. The impact is limited to integrity, with no confidentiality or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for it. Customers are advised to review Oracle's Critical Patch Update documentation and apply patches as soon as they become available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Contracts Integration. This compromises data integrity but does not affect confidentiality or availability. The vulnerability requires network access via HTTP and is difficult to exploit, which reduces the likelihood of successful attacks. There are no known exploits in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm a patch or remediation level for CVE-2026-62484. Customers should monitor Oracle's official security advisories and apply Critical Patch Updates promptly when patches for this vulnerability become available. Until then, no specific workaround or temporary fix is documented. Maintaining supported versions and timely patching is strongly recommended by Oracle.