VDB
CVE-2026-62546
CVE-2026-62546
PUBLISHED
CVSS 9.1 CRITICAL
Reported by oracle · Published July 21, 2026
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. While the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Scores
CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Oracle Applications Framework | 12.2.8 |
| Oracle Corporation | Oracle Applications Framework | 12.2.8, 12.2.8 |
| oracle | applications_framework | 12.2.8, 12.2.8 |
Timeline
- Jul 21, 2026 CVE Published
- Jul 22, 2026 Coalition ESS Score
- Jul 26, 2026 EPSS Score
- Aug 6, 2026 CVE Updated
References
- Oracle Advisory vendor-advisory