CVE-2026-62542: Medium severity Oracle Oracle E-Business Suite vulnerability
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Benefits accessible data as well as unauthorized read access to a subset of Oracle Advanced Benefits accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Benefits. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite (Self Service Benefits) - Oracle Advanced Benefitsto a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15 - Compensating control
Because exploitation is described as network-based via HTTP and can be performed by a low-privileged attacker, restrict network access to Oracle Advanced Benefits Self Service Benefits over HTTP to only trusted clients/sources (e.g., via firewall/ACL/segmentation), and ensure non-required HTTP paths are not reachable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62542?
The severity of CVE-2026-62542 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-62542?
To fix CVE-2026-62542, update your Oracle E-Business Suite to a version that is not affected, specifically versions beyond 12.2.15.
What products are affected by CVE-2026-62542?
CVE-2026-62542 affects the Oracle Advanced Benefits product within the Oracle E-Business Suite for versions 12.2.3 to 12.2.15.
Who is at risk from CVE-2026-62542?
Low privileged attackers with network access via HTTP are at risk of exploiting CVE-2026-62542.
What type of vulnerability is CVE-2026-62542?
CVE-2026-62542 is an easily exploitable vulnerability that allows unauthorized access to the Oracle Advanced Benefits system.