CVE-2026-62496: High severity Oracle Oracle Yard Management vulnerability
Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Yard Management (Internal Operations)to a version that resolves this vulnerability.Fixed in 12.2.6-12.2.15 - Compensating control
Restrict network access to Oracle Yard Management over HTTP so that low-privileged attackers cannot reach the vulnerable component via HTTP (AV:N).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62496?
The severity of CVE-2026-62496 is rated high with a CVSS score of 8.8.
How do I fix CVE-2026-62496?
To fix CVE-2026-62496, apply the latest security patches provided by Oracle for the affected versions.
What kind of access is required to exploit CVE-2026-62496?
CVE-2026-62496 requires low privileged access with network connectivity via HTTP to exploit.
Which versions of Oracle E-Business Suite are affected by CVE-2026-62496?
CVE-2026-62496 affects Oracle E-Business Suite versions 12.2.6 through 12.2.15.
What components of Oracle E-Business Suite are impacted by CVE-2026-62496?
CVE-2026-62496 impacts the Oracle Yard Management component within Oracle E-Business Suite.