This vulnerability affects Oracle Yard Management versions 12.2.6 through 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack can be performed remotely with low complexity and privileges, without user interaction, and results in high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly state the patch status for this vulnerability. The advisory strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Yard Management, impacting confidentiality, integrity, and availability of the system. This could lead to complete takeover of the affected product, posing significant risk to operations relying on Oracle Yard Management.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. Although the advisory does not explicitly confirm a patch for CVE-2026-62496, it is part of the Critical Patch Update cycle, implying that patches may be included. Organizations should review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until patches are applied, limit network exposure of Oracle Yard Management and restrict access to trusted users where possible.