CVE-2026-62607: High severity Oracle Oracle E-Business Suite - Customer Care vulnerability
Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Customer Care. While the vulnerability is in Oracle Customer Care, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Care accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Care accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high privileges and network access to the Oracle Customer Care Internal Operations component over HTTP. No user interaction is required, and the vulnerability is rated as easily exploitable under those conditions.
Which deployments are affected?
Affected supported Oracle Customer Care versions are 12.2.3 through 12.2.15. The provided information does not state whether any particular default configuration changes exposure.
What could a successful attacker do?
A successful attacker could gain unauthorized access to critical data or all data accessible through Oracle Customer Care, and could create, delete, or modify critical data or all Oracle Customer Care-accessible data. The scope change indicates impacts may significantly affect additional products.