Description
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and integrity breach
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the Create Item Instance component of Oracle E‑Business Suite’s Installed Base. An attacker with low privileges and network access over HTTP could compromise the Installed Base, enabling unauthorized read, update, insert, or delete operations on data accessible through that module. The flaw results in confidentiality and integrity impacts, with the possibility of gaining broad access to all data the Installed Base can reach.

Affected Systems

Affected vendors and products are Oracle Corporation’s Installed Base component of Oracle E‑Business Suite, specifically supported versions 12.2.3 through 12.2.15. No other unit is listed as impacted, but attacks that succeed in Installed Base could influence additional Oracle products due to scope change. Version details are limited to the defined range; further refinement may be necessary.

Risk and Exploitability

The CVSS score of 7.6 indicates a high severity, with low attack complexity and low privileges required. EPSS information is not available. The vector requires user interaction, so a human must be prompted to facilitate the exploit. Because the flaw can change the scope to affect more components, the potential impact expands beyond the installed base. The vulnerability is not yet listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 21, 2026 at 02:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review Oracle CPU Oct 2026 for a patch or update addressing the Installed Base Create Item Instance flaw and apply it promptly
  • Restrict HTTP access to the Installed Base interface to trusted networks or users and disable unnecessary services
  • Implement application‑layer filtering or a web application firewall to block known exploit patterns and monitor for unauthorized insert, update, or delete activity

Generated by OpenCVE AI on October 21, 2026 at 02:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Remote Data Breach via Installed Base Create Item Instance
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle installed Base
CPEs cpe:2.3:a:oracle:installed_base:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle installed Base
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Installed Base
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:50:06.504Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101849

cve-icon Vulnrichment

Updated: 2026-10-27T11:49:38.125Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:40.833

Modified: 2026-10-27T12:16:58.180

Link: CVE-2026-101849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:00:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control