CVE-2026-62472: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-62472 Overview

CVE-2026-62472 is a broken access control vulnerability [CWE-284] in the Oracle Installed Base product of Oracle E-Business Suite. The flaw resides in the Create Item Instance component and affects supported versions 12.2.4 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness to compromise the confidentiality and integrity of Oracle Installed Base data. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Installed Base accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read, create, modify, or delete any data accessible to Oracle Installed Base without further privilege escalation.

Affected Products

Oracle E-Business Suite — Oracle Installed Base 12.2.4
Oracle E-Business Suite — Oracle Installed Base versions 12.2.5 through 12.2.14
Oracle E-Business Suite — Oracle Installed Base 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-62472 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-62472

Vulnerability Analysis

The vulnerability exists in the Create Item Instance component of Oracle Installed Base, a module used to track installed products and services across the E-Business Suite. Improper access control [CWE-284] allows a user holding any low-privileged E-Business Suite account to invoke item instance operations that should be restricted to authorized roles. The confidentiality and integrity impacts are rated High, while availability is not affected. Exploitation requires only HTTP access to the application tier, no user interaction, and no elevated privileges. Oracle categorizes the issue as easily exploitable in its July 2026 security alert.

Root Cause

The defect stems from missing or insufficient authorization checks on the Create Item Instance operation. The server-side handler does not verify that the requesting session holds the role or responsibility required to create, modify, or read Installed Base records. Authentication is enforced, but authorization is not, producing a classic broken access control condition.

Attack Vector

An attacker authenticates to the E-Business Suite with any valid low-privilege account. The attacker then issues crafted HTTP requests directly to the Installed Base endpoints exposed by the Create Item Instance component. Because the server accepts the request without verifying entitlement, the attacker can create arbitrary item instances, alter existing records, or retrieve data belonging to any Installed Base object. The attack is remote, network-based, and does not require social engineering or client-side interaction.

See the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-62472

Indicators of Compromise

Unexpected CREATE, UPDATE, or DELETE operations against CSI_ITEM_INSTANCES and related Installed Base tables from low-privileged application accounts.
HTTP requests to Installed Base Create Item Instance endpoints originating from user sessions whose responsibilities do not include Installed Base management.
Bulk item instance creation or modification events occurring outside normal business processes or maintenance windows.

Detection Strategies

Review E-Business Suite application access logs for calls to Installed Base APIs by users lacking the Oracle Installed Base User or equivalent responsibility.
Enable database-level auditing on the CSI schema to record row-level changes and correlate them with the authenticated application user.
Alert on anomalous HTTP POST volumes to /OA_HTML/ paths tied to Installed Base servlets and forms.

Monitoring Recommendations

Forward Oracle application, middle-tier, and database audit logs to a centralized SIEM for correlation across identity, session, and data-tier events.
Baseline normal Installed Base activity per user and responsibility, then alert on deviations in operation type or volume.
Track failed authorization events surfaced by post-patch Oracle logging, as these indicate probing attempts against the fixed endpoint.

How to Mitigate CVE-2026-62472

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to any E-Business Suite deployment running Installed Base versions 12.2.4 through 12.2.15.
Inventory user accounts with access to the E-Business Suite and disable or review any inactive or shared low-privilege accounts.
Restrict network reachability of the E-Business Suite application tier to authenticated corporate networks and VPN users.

Patch Information

Oracle released fixes for CVE-2026-62472 as part of the Oracle Security Alert July 2026. Administrators should follow Oracle's published patch application procedure for E-Business Suite 12.2 and validate patch levels against Oracle Support notes referenced in the advisory.

Workarounds

No vendor-supplied workaround exists; patching is the required remediation path.
Where immediate patching is not feasible, place the Installed Base URLs behind a web application firewall rule that restricts access to users belonging to authorized responsibilities.
Reduce the account population able to authenticate to E-Business Suite until the patch is deployed.

bash

# Verify Installed Base patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF