OracleCVE-2026-62534

Oracle Applications Framework: takeover via Web Utilities

CVE-2026-62534 · Published Jul 21, 2026 · updated Aug 6, 2026

High8.8

No fix yet

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Package	Affected	Fixed in
Oracle Applications Framework Product	>= 12.2.11, <= 12.2.15	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-269, CWE-284, CWE-287, CWE-306

More Oracle advisories

All Oracle

High 7.8Jul 21

Oracle HRMS (US): takeover via Internal OperationsCVE-2026-62561no fix yet Medium 6.5Jul 21

Oracle HRMS (US): data exposure via Internal OperationsCVE-2026-62562no fix yet Medium 5.4Jul 21

Oracle Work in Process: data tampering via Internal OperationsCVE-2026-62563no fix yet High 7.1Jul 21

Oracle HRMS (US): data tampering via US Payroll Year EndCVE-2026-62565no fix yet High 7.7Jul 21

Oracle HRMS (UK): data exposure via UK PayrollCVE-2026-62567no fix yet High 7.8Jul 21

Oracle Java SE: takeover via InstallCVE-2026-62574no fix yet