CVE-2026-60904
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Installed Base component, specifically in the Create Item Instance functionality, representing a critical security weakness that affects versions 12.2.3 through 12.2.15. The flaw manifests as an insufficient authorization check that permits low-privileged attackers with network access via HTTP to execute unauthorized operations against the installed base data repository. The vulnerability's exploitability is classified as easily accessible, meaning that an attacker requires minimal privileges and can leverage standard network protocols to initiate attacks without requiring specialized tools or extensive reconnaissance. This weakness directly violates fundamental security principles by allowing unauthorized modification of critical business data through a seemingly routine administrative function.
The technical implementation of this vulnerability stems from inadequate input validation and access control mechanisms within the Create Item Instance process. When an authenticated user submits requests to create item instances, the system fails to properly verify whether the requesting user possesses sufficient privileges to perform the requested operations on the target data objects. This authorization bypass allows attackers to manipulate the system into processing unauthorized data modifications that would normally require elevated permissions. The vulnerability's impact extends beyond simple data corruption to encompass complete compromise of data integrity and confidentiality within the installed base environment, as attackers can create, delete, or modify critical business data without proper authorization.
The operational consequences of this vulnerability are severe and far-reaching for organizations utilizing affected Oracle E-Business Suite versions. Attackers can potentially access sensitive customer information, product catalog data, and inventory records that form the foundation of business operations. The confidentiality impact is rated as high because unauthorized parties can gain access to all accessible data within the installed base system, while the integrity impact reflects the ability to modify critical business data without detection. This vulnerability essentially provides attackers with a backdoor into core operational data that could disrupt business continuity, compromise competitive advantages, and expose organizations to regulatory compliance violations. The lack of user interaction requirement means that attacks can be automated and executed without direct human involvement, increasing both the frequency and potential damage of successful exploitation attempts.
Organizations should prioritize immediate remediation through Oracle's official security patches, as this vulnerability represents a significant risk to business-critical data systems. The recommended mitigation strategy involves applying the latest cumulative updates and security fixes provided by Oracle to address the authorization bypass in the Create Item Instance functionality. Additionally, implementing network segmentation and access controls can help reduce the attack surface by limiting direct HTTP access to the affected components. Security monitoring should be enhanced to detect anomalous patterns in item instance creation requests and unauthorized data modification activities. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of the principle of least privilege, making it a prime target for exploitation by both internal and external threat actors seeking to compromise enterprise business systems. Organizations should also conduct thorough access control reviews to ensure that only authorized personnel maintain privileges to perform item instance creation operations within their Oracle E-Business Suite environments.