This vulnerability affects Oracle HRMS (US) versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely with low attack complexity, requires high privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a high severity rating of 7.2. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation details for this specific issue. Customers are urged to remain on supported versions and apply patches without delay.

Successful exploitation can lead to complete compromise of Oracle HRMS (US), affecting confidentiality, integrity, and availability of the system. The attacker must have high privileges and network access via HTTP. The impact includes potential takeover of the affected Oracle HRMS (US) system, which could disrupt business operations and expose sensitive data.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-62548, customers should promptly apply the July 2026 Critical Patch Update and any subsequent updates to ensure protection. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed; users should monitor Oracle's official security alerts for updates.