CVE-2026-62462: Oracle Work in Process Auth Bypass Flaw

CVE-2026-62462 Overview

CVE-2026-62462 is a high-severity vulnerability in the Oracle Work in Process product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this vulnerability without user interaction. Successful exploitation results in full takeover of Oracle Work in Process, with impacts to confidentiality, integrity, and availability.

Critical Impact
Authenticated remote attackers can compromise Oracle Work in Process, leading to takeover of the application and its data.

Affected Products

Oracle E-Business Suite - Oracle Work in Process version 12.2.3
Oracle E-Business Suite - Oracle Work in Process versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Work in Process version 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-62462 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-62462

Vulnerability Analysis

CVE-2026-62462 resides in the Internal Operations component of Oracle Work in Process, part of Oracle E-Business Suite. The vulnerability is easily exploitable and reachable over the network via HTTP. Oracle has not published detailed technical information beyond the advisory. The flaw permits an authenticated user with low privileges to escalate access and take over the Oracle Work in Process application. Because Work in Process handles manufacturing job execution, cost accounting, and shop floor transactions, a compromise directly exposes production data and business workflows.

Root Cause

Oracle has not disclosed the underlying weakness class in the public advisory. Based on the CVSS profile, the flaw is reachable over HTTP by an authenticated, low-privileged user and does not require user interaction. Consult the Oracle Security Alert for vendor-provided technical context.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires valid low-privilege credentials to the Oracle E-Business Suite environment. From an authenticated session, the adversary sends crafted HTTP requests to the Internal Operations component of Oracle Work in Process. No user interaction is required, and attack complexity is low. Successful exploitation grants attacker control over the Work in Process application, including read and write access to manufacturing data.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-62462

Indicators of Compromise

Unexpected HTTP requests to Oracle Work in Process Internal Operations endpoints originating from low-privilege user sessions.
Anomalous changes to Work in Process transactions, job records, or cost accounting entries outside normal business hours.
New or modified application-tier files, concurrent programs, or database objects tied to the APPS schema without a corresponding change ticket.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Work in Process responsibility.
Correlate web-tier access logs from Oracle HTTP Server with application session identifiers to surface abnormal request patterns.
Alert on database-level audits for WIP.* table modifications performed outside of expected concurrent processes.

Monitoring Recommendations

Forward Oracle HTTP Server, application, and database audit logs to a centralized SIEM for retention and correlation.
Baseline normal Work in Process HTTP request volumes per user and flag deviations for review.
Monitor privileged role assignments and responsibility grants in Oracle E-Business Suite for unexplained escalations.

How to Mitigate CVE-2026-62462

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert to all affected Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle Work in Process deployments and confirm patch status against Oracle's advisory.
Rotate credentials for any account that may have been exposed and review responsibility assignments for least privilege.

Patch Information

Oracle addressed CVE-2026-62462 in the August 2026 Oracle Security Alert. Administrators should download and apply the patches listed on the Oracle Security Alert page for Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewalls, VPN, or reverse proxy allowlists until patching completes.
Reduce the number of accounts granted Work in Process responsibilities to enforce least privilege.
Enforce multi-factor authentication on Oracle E-Business Suite user sign-on to reduce the value of stolen low-privilege credentials.

bash

# Verify Oracle E-Business Suite patch level after applying the August 2026 update
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 ORDER BY last_update_date DESC
 FETCH FIRST 20 ROWS ONLY;
EXIT;
EOF