CVE-2026-62473 Overview
CVE-2026-62473 affects the Oracle Installed Base product within Oracle E-Business Suite, specifically the Create Item Instance component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful exploitation grants unauthorized creation, deletion, or modification access to critical data, complete read access to all Oracle Installed Base data, and the ability to cause a partial denial of service. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Authenticated attackers can read, modify, and delete all Oracle Installed Base data over HTTP, and trigger a partial denial of service against the application.
Affected Products
- Oracle E-Business Suite — Oracle Installed Base 12.2.3 through 12.2.15
- Component: Create Item Instance
- Deployments exposing Oracle E-Business Suite HTTP interfaces to authenticated users
Discovery Timeline
- 2026-07-21 - CVE-2026-62473 published to NVD
- 2026-07-22 - Last updated in NVD database
- Vendor advisory published as part of the Oracle Critical Patch Update - July 2026
Technical Details for CVE-2026-62473
Vulnerability Analysis
The vulnerability resides in the Create Item Instance component of Oracle Installed Base. An authenticated user with low privileges can send crafted HTTP requests that bypass access controls governing item instance operations. The result is broad unauthorized access across the module's data set, including confidentiality and integrity impacts on all Oracle Installed Base accessible data.
The issue is network-exploitable and does not require user interaction. Because Oracle Installed Base tracks asset ownership, service contracts, and configuration state for enterprise assets, unauthorized modification can cascade into downstream Oracle E-Business Suite modules that consume installed base data.
Root Cause
The vulnerability is categorized as [CWE-200], indicating improper restriction of information exposure. The Create Item Instance flow does not sufficiently constrain what data a low-privileged principal can read or manipulate through its HTTP endpoints. The vendor advisory does not disclose the specific code paths involved.
Attack Vector
Exploitation requires network access over HTTP and valid low-privileged credentials to the Oracle E-Business Suite environment. The attacker interacts with the Create Item Instance component to trigger unauthorized reads, writes, deletions, and partial service degradation. No user interaction is required, and the scope remains unchanged.
No public proof-of-concept exploit code has been published for CVE-2026-62473. Refer to the Oracle Critical Patch Update - July 2026 for vendor-supplied technical context.
Detection Methods for CVE-2026-62473
Indicators of Compromise
- Unexpected creation, modification, or deletion events on CSI_ITEM_INSTANCES and related Installed Base tables from low-privileged accounts
- HTTP requests to Oracle Installed Base Create Item Instance endpoints from user sessions that historically do not access this module
- Application-tier errors or slowdowns consistent with partial denial of service in the Installed Base servlets
Detection Strategies
- Enable and review Oracle E-Business Suite auditing on Installed Base tables, focusing on inserts, updates, and deletes performed by low-privileged responsibilities
- Correlate web-tier access logs with database audit trails to identify anomalous Create Item Instance call patterns
- Baseline normal user-to-module activity and alert on privilege-to-function mismatches
Monitoring Recommendations
- Ingest Oracle E-Business Suite application, database, and web server logs into a centralized SIEM for correlation
- Alert on high-volume Installed Base modifications outside of change windows or batch jobs
- Monitor authentication logs for reuse of low-privileged EBS accounts from unusual source addresses
How to Mitigate CVE-2026-62473
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments
- Inventory all user accounts with access to Oracle Installed Base responsibilities and remove unnecessary grants
- Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted networks and VPN users
Patch Information
Oracle addresses this vulnerability in the Oracle Critical Patch Update - July 2026. Administrators should follow Oracle's documented patch application procedures for E-Business Suite 12.2, including any prerequisite patches and post-install steps for the Installed Base module.
Workarounds
- Reduce the population of users assigned Oracle Installed Base responsibilities until patching is complete
- Place Oracle E-Business Suite behind a reverse proxy or web application firewall to restrict access to Create Item Instance URLs
- Increase audit logging on Installed Base transactions to detect exploitation attempts pending patch deployment
# Example: enable auditing on the primary Installed Base table
sqlplus / as sysdba <<'SQL'
AUDIT INSERT, UPDATE, DELETE ON APPS.CSI_ITEM_INSTANCES BY ACCESS;
SQL
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
