CVE-2026-60907 in Installed Base
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.4-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Installed Base. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Installed Base component, specifically in the Create Item Instance functionality that operates under version ranges 12.2.4 through 12.2.15. The flaw represents a security weakness that enables low-privileged attackers to exploit network-based HTTP access points to compromise the installed base system. The vulnerability's classification as difficult to exploit indicates that while the attack vector exists, successful exploitation requires specific conditions and may not be easily automated. The CVSS 3.1 base score of 5.0 reflects a medium severity threat with balanced impacts across confidentiality, integrity, and availability domains.
The technical nature of this vulnerability stems from inadequate input validation or authorization controls within the Create Item Instance process, allowing malicious actors to manipulate system behavior through crafted HTTP requests. Attackers can leverage this weakness to perform unauthorized data modifications including updates, inserts, and deletions against specific portions of the Installed Base database. Additionally, the vulnerability permits unauthorized read access to restricted data subsets, potentially exposing sensitive information about installed items and their configurations. The partial denial of service capability means attackers can disrupt system availability for certain operations while maintaining operational functionality for others.
From a security framework perspective, this vulnerability maps to CWE-287 (Improper Authentication) and potentially CWE-352 (Cross-Site Request Forgery) depending on the exact implementation details of the authorization checks. The attack surface aligns with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers may need to establish legitimate network access before exploiting this weakness. Organizations should implement immediate mitigations including strengthening authentication mechanisms, applying Oracle's security patches, and configuring network-level restrictions to limit HTTP access to only trusted sources. Regular security assessments and monitoring for anomalous data modification patterns are essential for early detection of potential exploitation attempts.
The impact extends beyond simple data compromise as the partial denial of service component can disrupt business operations involving item tracking and inventory management. System administrators should consider implementing additional logging and audit controls to monitor access patterns to the Create Item Instance functionality. Network segmentation strategies should isolate critical Oracle E-Business Suite components from general network access to reduce attack surface. Regular vulnerability assessments and security awareness training for system administrators will help maintain defense in depth against similar threats targeting enterprise resource planning systems.