CVE-2026-60738 in Installed Base
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in takeover of Oracle Installed Base. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Installed Base component, specifically in the Create Item Instance functionality that operates under version ranges 12.2.3 through 12.2.15. The flaw represents a critical security weakness that enables low-privileged attackers to execute successful exploitation through network-based HTTP connections, demonstrating a significant risk to enterprise environments relying on this Oracle product suite. The vulnerability's classification as easily exploitable indicates that the attack vector requires minimal technical expertise or resources, making it particularly dangerous for organizations with inadequate security controls.
The technical implementation of this vulnerability stems from insufficient input validation and access control mechanisms within the Create Item Instance process. Attackers can leverage HTTP network access to manipulate application parameters and potentially bypass authentication checks, leading to unauthorized system compromise. The CVSS 3.1 scoring system assigns a base score of 8.8, reflecting high severity across all impact categories including confidentiality, integrity, and availability, which collectively indicate that successful exploitation could result in complete system takeover. This comprehensive impact assessment places the vulnerability in the critical severity tier according to industry standards.
The operational implications of this vulnerability extend beyond simple data compromise, as it provides attackers with complete control over the Oracle Installed Base system. Organizations utilizing affected versions face potential data breaches, system corruption, and service disruption that could affect business operations and regulatory compliance. The low privilege requirement means that even users with minimal system access could potentially escalate their privileges and gain administrative control. This vulnerability directly impacts the integrity of installed base data and can compromise the entire Oracle E-Business Suite environment, particularly affecting inventory management and asset tracking functionalities.
Security mitigations for this vulnerability should prioritize immediate patching of affected Oracle E-Business Suite versions through official Oracle security updates and CPU releases. Organizations must implement network segmentation to limit HTTP access to only authorized administrative systems and consider deploying web application firewalls to monitor and filter potentially malicious requests targeting the vulnerable Create Item Instance functionality. Additional protective measures include implementing robust access controls, monitoring system logs for suspicious activities, and conducting regular vulnerability assessments to identify similar weaknesses in related applications. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern under ATT&CK framework category TA0006 (Credential Access) and TA0005 (Defense Evasion), requiring comprehensive remediation strategies that address both immediate exploitation prevention and long-term security posture strengthening.