CVE-2026-60908 in Installed Base
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Installed Base accessible data as well as unauthorized update, insert or delete access to some of Oracle Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Installed Base component, specifically in the Create Item Instance functionality where the flaw manifests as an insufficient input validation mechanism. The vulnerability affects versions 12.2.3 through 12.2.15, representing a significant attack surface given the widespread deployment of these Oracle EBS versions across enterprise environments. The security weakness enables a low-privileged attacker to exploit network-based HTTP connections, exploiting a path traversal or injection flaw that allows unauthorized access to sensitive data within the installed base system.
The technical exploitation involves leveraging the Create Item Instance function to manipulate input parameters in ways that bypass authentication and authorization controls. This vulnerability operates at the application layer where user inputs are not properly sanitized or validated before being processed by the backend database operations. The flaw allows for both read and write access patterns, enabling attackers to extract confidential information or modify existing records within the installed base data repository. The CVSS 3.1 score of 7.1 reflects the high severity of this issue with a medium attack complexity but low privilege requirements.
The operational impact extends beyond simple data theft as attackers can achieve complete compromise of accessible Oracle Installed Base data, including sensitive inventory and configuration information. This vulnerability enables unauthorized update, insert, or delete operations against specific data sets within the installed base, potentially leading to data corruption or manipulation that could affect business operations and compliance requirements. The confidentiality and integrity impacts are particularly severe given that the installed base typically contains critical operational data about deployed software instances, hardware configurations, and licensing information.
Security controls such as proper input sanitization, parameterized queries, and robust access controls should be implemented to mitigate this vulnerability. Organizations should enforce network segmentation to limit access points to Oracle EBS applications and implement comprehensive monitoring for unusual access patterns in the installed base component. The vulnerability aligns with CWE-20 (Improper Input Validation) and represents a significant risk under ATT&CK framework category T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS). Patch management should be prioritized with immediate implementation of Oracle's security patches, while network-based intrusion detection systems should monitor for exploitation attempts targeting HTTP endpoints serving Oracle EBS functionality.
The vulnerability demonstrates how application-level flaws in enterprise resource planning systems can create cascading security risks that extend beyond individual components to affect entire organizational data repositories. Organizations relying on Oracle EBS installed base functionality must conduct thorough risk assessments and consider implementing additional defensive measures including database activity monitoring, privilege reviews, and enhanced network access controls. The low privilege requirement combined with network accessibility makes this vulnerability particularly attractive to attackers seeking persistent access to enterprise data stores. Security teams should also evaluate their incident response procedures to ensure rapid detection and remediation of exploitation attempts targeting this specific Oracle EBS component.
Mitigation strategies should include implementing the latest Oracle security patches, configuring proper web application firewalls, and establishing database-level access controls that limit direct access to sensitive installed base tables. Regular security assessments of Oracle EBS implementations are crucial to identify similar vulnerabilities across other components within the suite. The vulnerability highlights the importance of maintaining up-to-date security configurations and demonstrates how seemingly minor input validation issues can result in significant data exposure risks when operating in enterprise environments with complex application architectures.