CVE-2026-62542
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in Oracle Advanced Benefits (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.
Risk Assessment
The risk includes compromise of confidentiality, integrity, and availability of data in the Oracle Advanced Benefits module, potentially affecting HR and payroll processes.
Recommendation
Apply Oracle patches per the Critical Patch Update schedule and restrict network access to the system.
Other vulnerabilities in Oracle Advanced Benefits
See all- CVE-2026-61325High
Vulnerability in Oracle Advanced Benefits (part of Oracle E-Business Suite) version 12.2.15. An authenticated attacker with high privileges can access critical data and modify some data via HTTP.
- CVE-2026-61324High
Vulnerability in Oracle Advanced Benefits of Oracle E-Business Suite (component: Internal Operations). Affects version 12.2.15. A low-privileged attacker with network access via HTTP can compromise Oracle Advanced Benefits, potentially impacting additional products (scope change). Successful attacks can lead to unauthorized creation, deletion, or modification of critical data. CVSS 7.7 (Integrity impacts).
- CVE-2026-61141High
Vulnerability in Oracle Advanced Benefits (component: Affordable Care Act) versions 12.2.7-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to compromise the system.
Original NVD description (English source)
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Benefits accessible data as well as unauthorized read access to a subset of Oracle Advanced Benefits accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Benefits. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).