Description
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Create Item Instance component of Oracle E‑Business Suite’s Oracle Installed Base. A low‑privileged attacker with network access over HTTP can create, delete, or modify records in the installed base system without proper authorization, allowing unauthorized access to critical data and compromising the integrity of the entire base.

Affected Systems

Oracle Installed Base product of Oracle E‑Business Suite, versions 12.2.4 through 12.2.15.

Risk and Exploitability

The CVSS v3.1 Base Score of 8.1 indicates high severity with significant confidentiality and integrity impact. The attack vector is network‑based over HTTP (AV:N), requiring low effort (AC:L) and low privileges (PR:L) while no user interaction is needed (UI:N). The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, yet systems with open HTTP access to the Installed Base are potentially vulnerable.

Generated by OpenCVE AI on August 4, 2026 at 00:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch detailed in Oracle’s CPUJul2026 Security Alert to address the flaw in Create Item Instance.
  • Configure network segmentation to restrict HTTP access to the Oracle Installed Base to privileged users or a secure internal network.
  • If a patch cannot be applied immediately, isolate affected systems from external networks, enforce strict firewall rules blocking HTTP traffic to the Oracle Installed Base, and monitor logs for suspicious Create Item Instance activity.

Generated by OpenCVE AI on August 4, 2026 at 00:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Installed Base via Create Item Instance Vulnerability

Sun, 02 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Remote HTTP Exploitation of Create Item Instance in Oracle E‑Business Suite Installed Base

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Remote HTTP Exploitation of Create Item Instance in Oracle E‑Business Suite Installed Base

Tue, 28 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Enables Unauthorized Data Modification in Oracle Installed Base

Sun, 26 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Enables Unauthorized Data Modification in Oracle Installed Base

Wed, 22 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle installed Base
CPEs cpe:2.3:a:oracle:installed_base:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle installed Base
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Installed Base
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T16:16:16.364Z

Reserved: 2026-07-14T14:54:48.733Z

Link: CVE-2026-62472

cve-icon Vulnrichment

Updated: 2026-07-22T16:16:13.073Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses