This vulnerability affects Oracle Contracts Integration versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 4.2, reflecting low confidentiality and integrity impacts, no availability impact, and requiring high attack complexity without user interaction. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

The vulnerability allows unauthorized read and write access to some data within Oracle Contracts Integration, potentially compromising confidentiality and integrity of that data. The impact is limited to certain accessible data subsets and does not affect availability. The attack requires network access via HTTP and is difficult to exploit due to high attack complexity and low privileges required.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. Although no explicit patch for CVE-2026-62489 is confirmed in the advisory content provided, customers should review the referenced Critical Patch Update and apply all relevant patches for Oracle Contracts Integration versions 12.2.3 through 12.2.15. Maintaining up-to-date software and applying Oracle's security patches without delay is advised.