This vulnerability affects Oracle Contracts Integration versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to perform unauthorized actions that could modify critical data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle emphasizes the importance of applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Contracts Integration. This compromises data integrity but does not affect confidentiality or availability. The vulnerability requires network access and low privileges, making it relatively accessible to attackers within the network environment.

Oracle's advisory does not explicitly state a patch or remediation for CVE-2026-62488 at this time. Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply all security patches promptly to mitigate this and other vulnerabilities.