This vulnerability affects Oracle Purchasing within Oracle E-Business Suite versions 12.2.11 to 12.2.15. It is a network-accessible vulnerability exploitable by a low privileged attacker over HTTP, requiring high attack complexity and no user interaction. The vulnerability impacts confidentiality, integrity, and availability, potentially allowing an attacker to take over Oracle Purchasing. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.5. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. Oracle strongly recommends applying security patches without delay to address vulnerabilities disclosed in their advisories.

Successful exploitation of this vulnerability can result in complete compromise of the Oracle Purchasing component, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over Oracle Purchasing, potentially leading to unauthorized access and control over purchasing operations within Oracle E-Business Suite.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple vulnerabilities, including those affecting Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-62493, Oracle recommends that customers remain on actively-supported versions and apply Critical Patch Updates promptly. Organizations using affected versions of Oracle Purchasing should monitor Oracle's advisory for patch availability and apply updates as soon as they are released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.