CVE-2019-2622: Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite (subcomponent: Renewals).

Security readout for executives and security teams

CVE-2019-2622 affects Oracle E-Business Suite Service Contracts Renewals. An unauthenticated attacker with HTTP network access could cause unauthorized changes to some Service Contracts data, but the attack requires a separate user interaction. The primary business risk is data integrity, not confidentiality or availability. Exposure is most likely where affected Oracle E-Business Suite Service Contracts versions are reachable over HTTP by untrusted users. Risk is lower if EBS is internal-only, tightly segmented, or the affected module is not deployed, but the source does not confirm module-specific exploit prerequisites beyond HTTP access and user interaction. Treat this as a moderate integrity-risk issue for Oracle E-Business Suite environments. It is not presented as actively exploited, but unauthenticated HTTP reachability and potential contract-data modification justify timely validation and patch planning, especially for systems supporting renewals, billing, or customer contract operations. Mitigation focus: Identify Oracle E-Business Suite instances running the listed affected versions.; Review Oracle April 2019 CPU guidance for the applicable EBS remediation path.; Apply vendor-recommended patches or upgrades for affected Service Contracts deployments..

Prepared

Jun 6, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.