This vulnerability affects Oracle HRMS (US) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. The Oracle July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific CVE. Customers are advised to review the advisory and apply patches promptly.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle HRMS (US). The confidentiality of sensitive information is at high risk, but there is no impact on data integrity or availability. This could result in data exposure to unauthorized parties.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product lines. Although the advisory does not explicitly confirm a patch for CVE-2026-62562, customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle HRMS (US) versions 12.2.3 through 12.2.15 without delay. Maintaining up-to-date patched versions is strongly recommended by Oracle to mitigate this vulnerability.