CVE-2026-62458: Oracle Work in Process DoS Vulnerability

CVE-2026-62458 Overview

CVE-2026-62458 is a vulnerability in the Oracle Work in Process product of Oracle E-Business Suite, specifically within the Internal Operations component. Affected releases include supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw without user interaction. Successful exploitation results in a complete denial of service (application hang or repeatable crash) of Oracle Work in Process, along with unauthorized update, insert, or delete access to a subset of accessible data.

Critical Impact
An authenticated network attacker can trigger a full DoS of Oracle Work in Process and modify a subset of application data, disrupting manufacturing operations dependent on the module.

Affected Products

Oracle E-Business Suite — Oracle Work in Process, version 12.2.3
Oracle E-Business Suite — Oracle Work in Process, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Work in Process, version 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-62458 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-62458

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Work in Process, a module of Oracle E-Business Suite used to manage discrete, repetitive, and flow manufacturing operations. An attacker authenticated with low privileges can send crafted HTTP requests to reach the vulnerable functionality. Exploitation results in a hang or a frequently repeatable crash, producing a complete denial of service. The same code path also permits unauthorized modification of a subset of Oracle Work in Process data through unauthorized insert, update, or delete operations.

The combination of a high availability impact and a partial integrity impact makes this issue material for enterprises that rely on E-Business Suite for production planning and shop-floor execution. Confidentiality is not affected. Oracle rates the flaw as easily exploitable, indicating no specialized conditions or user interaction are required beyond authentication and network reachability to the E-Business Suite HTTP endpoint.

Root Cause

Oracle has not published detailed root-cause information in the public advisory. Based on the CVSS metrics and impact description, the flaw is consistent with an input-validation or business-logic defect in an authenticated HTTP-accessible endpoint of the Internal Operations component. The endpoint accepts attacker-controlled input that both destabilizes the process handling the request and reaches persistence logic without adequate authorization checks on the affected data set.

Attack Vector

The attack vector is network-based over HTTP against an Oracle E-Business Suite deployment. The attacker must hold a valid low-privileged account on the target instance. Once authenticated, the attacker issues crafted requests to the Oracle Work in Process Internal Operations component. Refer to the Oracle Security Alert for vendor-supplied technical details.

No verified proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.263%.

Detection Methods for CVE-2026-62458

Indicators of Compromise

Unexpected hangs or repeated crashes of Oracle Work in Process processes and associated Oracle E-Business Suite application tier services.
Unexplained insert, update, or delete operations against Work in Process tables (for example, WIP_* schema objects) outside normal batch windows.
HTTP requests to Internal Operations endpoints originating from low-privileged or atypical user accounts.

Detection Strategies

Correlate Oracle E-Business Suite application-tier logs with database audit trails to identify anomalous DML activity from low-privileged sessions.
Monitor Oracle HTTP Server access logs for repeated POST requests to Work in Process Internal Operations URLs followed by application-tier restarts.
Baseline normal Work in Process transaction volumes per user role and alert on deviations that coincide with service instability.

Monitoring Recommendations

Enable Oracle Fine-Grained Auditing (FGA) on sensitive Work in Process tables to capture the session, SQL text, and bind values for insert, update, and delete operations.
Forward E-Business Suite application logs, Oracle HTTP Server logs, and database audit records to a centralized SIEM for correlation and retention.
Alert on repeated ORA- errors, JVM crashes, or concurrent manager failures tied to the Internal Operations component.

How to Mitigate CVE-2026-62458

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert covering Oracle E-Business Suite versions 12.2.3 through 12.2.15.
Inventory all E-Business Suite instances and confirm which run affected Oracle Work in Process releases.
Review and reduce the number of low-privileged accounts with access to the Work in Process Internal Operations component.

Patch Information

Oracle addresses this issue in the Critical Patch Update / Security Alert published at the Oracle Security Alert. Administrators should apply the associated patch bundle to all supported Oracle E-Business Suite 12.2.x environments and validate Work in Process functionality post-deployment in a non-production instance before promoting the change.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted internal networks and VPN users can reach the Work in Process Internal Operations endpoints.
Enforce least-privilege responsibilities in E-Business Suite so that users without an operational need cannot access Work in Process functions.
Increase monitoring of the Internal Operations component and be prepared to disable the affected responsibility if abuse is detected prior to patching.

bash

# Example: restrict access to E-Business Suite HTTP tier at the network layer
# Replace 10.0.0.0/8 with your authorized internal network ranges
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP