CVE-2026-62563: CSRF
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Work in Process accessible data as well as unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62563?
The severity of CVE-2026-62563 is medium with a CVSS score of 5.4.
How do I fix CVE-2026-62563?
To fix CVE-2026-62563, you should apply the latest patches provided by Oracle for affected versions of Oracle E-Business Suite.
Which versions of Oracle Work in Process are affected by CVE-2026-62563?
The affected versions of Oracle Work in Process are 12.2.5 to 12.2.15.
What type of vulnerability is CVE-2026-62563?
CVE-2026-62563 is a Cross-Site Request Forgery (CSRF) vulnerability.
Who can exploit CVE-2026-62563?
CVE-2026-62563 can be exploited by low privileged attackers with network access through HTTP.