CVE-2026-62451: Oracle Work in Process Auth Bypass Flaw

CVE-2026-62451 Overview

CVE-2026-62451 is an access control vulnerability [CWE-284] in the Oracle Work in Process product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.14 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Work in Process. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, plus full read access to all Oracle Work in Process accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can gain unauthorized access to and modify all data accessible through Oracle Work in Process over HTTP, with low attack complexity and no user interaction required.

Affected Products

Oracle E-Business Suite – Oracle Work in Process (Internal Operations component)
Version 12.2.14
Version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62451 published to NVD alongside Oracle Critical Patch Update July 2026
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-62451

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle Work in Process, a manufacturing execution module within Oracle E-Business Suite. The issue is categorized under [CWE-284] Improper Access Control, indicating that the application fails to enforce authorization checks on operations exposed over HTTP.

An attacker who already holds a low-privileged account within the E-Business Suite environment can reach the affected functionality remotely. Because the attack complexity is low and no user interaction is required, exploitation is straightforward for anyone with valid credentials and network reachability to the application tier.

Successful exploitation grants two distinct outcomes. First, the attacker gains read access to all data accessible through Oracle Work in Process. Second, the attacker can create, delete, or modify that data. Manufacturing records, work orders, routing data, and cost information are typical targets in this module.

Root Cause

The root cause is improper access control in the Internal Operations component. Authorization checks on privileged operations are missing or insufficient, allowing a low-privileged authenticated session to reach functions that should be restricted to higher-privileged roles.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite application tier. The attacker authenticates as a low-privileged user, then issues crafted HTTP requests to the Work in Process Internal Operations endpoints. No changes to system configuration or scope are required, and the vulnerability does not impact availability.

Refer to the Oracle Critical Patch Update July 2026 advisory for further technical context on the affected endpoints and fix details.

Detection Methods for CVE-2026-62451

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite user sessions to Work in Process Internal Operations URLs
Anomalous creation, deletion, or modification events in Work in Process tables outside of standard manufacturing workflows
Application-tier access logs showing repeated requests to Internal Operations servlets or JSPs from a single session

Detection Strategies

Enable and centralize Oracle E-Business Suite application-tier access logs and Sign-On Audit for user-level activity tracking
Correlate HTTP request patterns with Work in Process data change events in the database audit trail
Baseline normal Work in Process transactional volume per user role and alert on deviations, particularly from accounts not assigned manufacturing responsibilities

Monitoring Recommendations

Ingest E-Business Suite access_log, concurrent manager logs, and database audit records into your SIEM for correlation
Monitor for privilege drift and unusual responsibility assignments granting access to Work in Process functions
Alert on off-hours or high-volume data modification activity within Work in Process tables

How to Mitigate CVE-2026-62451

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.14 and 12.2.15
Inventory all low-privileged accounts with HTTP access to the E-Business Suite application tier and validate their assigned responsibilities
Restrict network access to the E-Business Suite application tier to trusted management and user networks only
Review recent Work in Process data changes for signs of unauthorized creation, deletion, or modification prior to patch deployment

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update July 2026. Administrators should apply the CPU following Oracle's documented patch procedure for E-Business Suite, including any prerequisite patches and post-install steps required for the Work in Process module.

Workarounds

Where immediate patching is not possible, remove or restrict the Work in Process responsibilities from accounts that do not require them
Place a web application firewall or reverse proxy in front of the E-Business Suite application tier to restrict access to Internal Operations URLs by source IP and authenticated role
Increase audit granularity on Work in Process schema objects to shorten identification time for any exploitation attempts

bash

# Verify installed E-Business Suite patch level after applying CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF