CVE-2026-62479: Oracle Public Sector Financials Auth Bypass

CVE-2026-62479 Overview

CVE-2026-62479 is an access control vulnerability [CWE-284] in the Oracle Public Sector Financials product of Oracle E-Business Suite, specifically within the Internal Operations component. Affected releases include supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this flaw, but successful exploitation requires human interaction from a user other than the attacker. Because the vulnerability crosses a security scope, exploitation can affect additional Oracle products beyond Public Sector Financials. Successful attacks grant unauthorized create, update, or delete access to some data and unauthorized read access to a subset of data.

Critical Impact
Authenticated attackers can leverage a scope-changing flaw to gain unauthorized read and write access to Oracle Public Sector Financials data and adjacent Oracle E-Business Suite products through user-assisted HTTP interaction.

Affected Products

Oracle E-Business Suite - Oracle Public Sector Financials 12.2.3
Oracle E-Business Suite - Oracle Public Sector Financials 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Public Sector Financials 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62479 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in the NVD database
July 2026 - Included in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-62479

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Public Sector Financials, part of Oracle E-Business Suite. The flaw is categorized under Improper Access Control [CWE-284], indicating that the component does not sufficiently restrict actions available to authenticated but low-privileged users. Because the vulnerability produces a scope change, exploitation extends impact beyond the vulnerable component into other Oracle E-Business Suite modules that share trust boundaries.

Exploitation requires a second user to interact with attacker-controlled content, consistent with client-side attack patterns such as reflected script execution or forged request delivery through the Internal Operations interface. Confidentiality and integrity are affected; availability is not impacted.

Root Cause

The root cause is inadequate access control enforcement within the Internal Operations component. The component accepts requests from an authenticated low-privileged user and performs actions that should require stronger authorization checks, allowing an attacker to bypass intended restrictions when a legitimate user interacts with malicious content.

Attack Vector

The attack proceeds over HTTP against the Oracle E-Business Suite instance. The attacker must hold valid low-privileged credentials and must convince another user, typically one holding higher privileges within the same or an adjacent product, to interact with crafted content. Oracle has not published exploitation details beyond the advisory. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-62479

Indicators of Compromise

Unexpected create, update, or delete transactions in Oracle Public Sector Financials records associated with low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user sessions immediately after clicking external links or opening attacker-supplied content.
Cross-module data changes in Oracle E-Business Suite that trace back to a single low-privileged session, indicating scope-crossing activity.

Detection Strategies

Correlate Oracle E-Business Suite application audit logs with web server access logs to identify low-privileged sessions performing privileged actions in Internal Operations.
Baseline normal referrer and user-agent patterns for the Internal Operations component and alert on deviations, especially requests initiated from external referrers.
Monitor Oracle FND audit tables for privileged data modifications tied to accounts that historically lack such permissions.

Monitoring Recommendations

Enable and centralize Oracle E-Business Suite sign-on and page-access auditing for all Public Sector Financials responsibilities.
Forward Oracle HTTP Server and WebLogic access logs to a SIEM with alerting on Internal Operations URIs.
Review changes to trusted redirect and framework profile options that could facilitate user-interaction-based exploitation.

How to Mitigate CVE-2026-62479

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite versions 12.2.3 through 12.2.15 as documented in the Oracle Security Alert July 2026.
Restrict access to the Oracle Public Sector Financials Internal Operations component to only responsibilities that require it.
Review recent activity in Internal Operations for anomalous cross-module changes performed by low-privileged users.

Patch Information

Oracle addressed CVE-2026-62479 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the advisory for Oracle E-Business Suite 12.2.3 through 12.2.15. Consult the vendor advisory for prerequisite patches and post-installation steps specific to Oracle Public Sector Financials.

Workarounds

Temporarily remove Internal Operations responsibilities from low-privileged users until patches are applied.
Enforce URL allow-listing at the reverse proxy or web application firewall for Oracle E-Business Suite endpoints to reduce exposure to user-interaction attacks.
Provide user awareness communications warning against interacting with untrusted links while authenticated to Oracle E-Business Suite.

bash

# Configuration example: restrict Internal Operations access via responsibility exclusions
# Navigate: System Administrator > Security > Responsibility > Define
# Add function/menu exclusions for the Internal Operations component
# Then bounce Oracle E-Business Suite services:
adstpall.sh apps/<apps_password>
adstrtal.sh apps/<apps_password>