This vulnerability affects Oracle Yard Management versions 12.2.6 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication), and CWE-269 (Improper Privilege Management). Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to complete compromise of Oracle Yard Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the product and potentially disrupt operations or access sensitive data.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-62496. Patch status is not yet confirmed—users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant security patches promptly once available. Until a patch is confirmed, restrict network access to Oracle Yard Management interfaces and monitor for unusual activity.