CVE-2026-62563 is a vulnerability in the Oracle Work in Process component of Oracle E-Business Suite versions 12.2.5 through 12.2.15. It permits a low privileged attacker with network access via HTTP to exploit the system, requiring user interaction from a third party. The vulnerability can result in unauthorized modification (update, insert, delete) and unauthorized read access to certain Oracle Work in Process data. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) with confidentiality and integrity impacts and scope change affecting additional products. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized read access and unauthorized update, insert, or delete operations on some data accessible by Oracle Work in Process. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, other Oracle products may also be significantly impacted. The CVSS score of 5.4 reflects a medium severity risk. No known active exploitation has been reported.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. However, the advisory does not explicitly confirm the availability of a specific patch or remediation for CVE-2026-62563. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Until a specific patch is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.