CVE-2026-62472 in Installed Base
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Installed Base component, specifically in the Create Item Instance functionality, representing a critical security weakness that affects versions 12.2.4 through 12.2.15. The flaw operates as an easily exploitable vulnerability that requires minimal privileges and can be initiated through network-based HTTP access, making it particularly dangerous for organizations with exposed web interfaces. The vulnerability's classification under CWE-284 (Improper Access Control) indicates fundamental flaws in the authorization mechanisms that govern access to sensitive system resources.
The technical implementation of this vulnerability stems from insufficient validation and authorization checks within the item instance creation process, allowing attackers to manipulate the system's data handling procedures without proper authentication. Attackers with low privilege network access can exploit this weakness to perform unauthorized operations including creating, deleting, or modifying critical data within the Installed Base system. The vulnerability's CVSS 3.1 score of 8.1 reflects the high impact on both confidentiality and integrity aspects, with a vector indicating network accessibility, low attack complexity, and the requirement for only low privileges to execute successful attacks.
The operational impact extends beyond simple data manipulation, as successful exploitation can lead to complete unauthorized access to all Oracle Installed Base accessible data, potentially compromising entire inventory management systems that track installed items across business operations. This represents a significant risk for organizations relying on E-Business Suite for critical business functions including asset tracking, maintenance scheduling, and inventory control processes. The vulnerability's potential for data exposure and modification creates risks for business continuity and regulatory compliance, particularly in industries governed by strict data protection requirements.
Organizations should implement immediate mitigations including applying Oracle's security patches, implementing network segmentation to limit access to the affected components, and enforcing strict access controls around the Installed Base functionality. Security monitoring should focus on identifying unauthorized access attempts and unusual data modification patterns within the Installed Base system. The ATT&CK framework categorizes this vulnerability under privilege escalation and data manipulation techniques, emphasizing the need for comprehensive security controls that address both network-level access restrictions and internal authorization checks. Additionally, organizations should conduct thorough vulnerability assessments to identify other potential entry points within their Oracle E-Business Suite deployments and establish robust monitoring procedures to detect exploitation attempts against similar components.