CVE-2026-87152 Overview
CVE-2026-87152 is a high-severity vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically within the Create Item Instance component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access over HTTP to compromise Oracle Installed Base. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle Installed Base accessible data.
Critical Impact
An authenticated remote attacker can compromise the confidentiality and integrity of all data accessible to Oracle Installed Base through the Create Item Instance component.
Affected Products
- Oracle E-Business Suite — Oracle Installed Base 12.2.3
- Oracle E-Business Suite — Oracle Installed Base 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Installed Base 12.2.15
Discovery Timeline
- 2026-09-15 - CVE-2026-87152 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-87152
Vulnerability Analysis
The vulnerability resides in the Create Item Instance component of Oracle Installed Base, a module of Oracle E-Business Suite used to track installed products across their lifecycle. An attacker holding low-privileged application credentials can send crafted HTTP requests to the affected component and gain unauthorized read and write access to Installed Base data.
Exploitation does not require user interaction and can be triggered over the network. The scope remains unchanged, meaning the attacker acts within the security context of the vulnerable component, but that context grants access to all data available to Oracle Installed Base. Availability is not impacted according to Oracle's advisory.
Root Cause
Oracle has not published detailed technical root cause information in the public advisory. The impact profile — high confidentiality and integrity impact with network exploitability and low privilege requirements — is consistent with a broken access control or missing authorization check on the Create Item Instance code path. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative vendor guidance.
Attack Vector
The attack vector is network-based over HTTP. An authenticated user with minimal application privileges submits crafted requests to the Create Item Instance interface. The server processes these requests without enforcing sufficient authorization, permitting the attacker to read, create, modify, or delete records the account should not access. No victim interaction is required.
No public proof-of-concept exploit is available at the time of publication. The EPSS probability is approximately 0.392%, indicating a low current likelihood of exploitation, though this can change as details emerge.
Detection Methods for CVE-2026-87152
Indicators of Compromise
- Unexpected creation, modification, or deletion of records in Oracle Installed Base tables such as CSI_ITEM_INSTANCES and related transaction tables.
- HTTP requests to Installed Base Create Item Instance endpoints originating from user accounts that do not typically interact with Installed Base workflows.
- Anomalous spikes in Installed Base API call volume from a single low-privileged session or source IP.
Detection Strategies
- Enable Oracle E-Business Suite auditing on Installed Base modules and forward audit records to a centralized SIEM for correlation.
- Baseline normal Installed Base activity per user role and alert on deviations, especially bulk create, update, or delete operations by low-privileged accounts.
- Inspect web tier and application server logs for HTTP requests targeting Installed Base servlets from unexpected user agents or session contexts.
Monitoring Recommendations
- Correlate Oracle E-Business Suite application logs with identity provider logs to detect misuse of low-privileged accounts.
- Monitor for lateral movement patterns where an authenticated EBS session pivots into Installed Base data queries outside the user's job function.
- Retain HTTP access logs for the EBS web tier long enough to support retrospective hunting once additional indicators are published.
How to Mitigate CVE-2026-87152
Immediate Actions Required
- Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 as soon as change windows permit.
- Inventory all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Oracle Installed Base and prioritize internet-exposed instances.
- Review Installed Base user roles and remove unnecessary privileges from accounts that do not require access to the Create Item Instance function.
Patch Information
Oracle addresses this vulnerability in the security alert tracked as CSPUSEP2026. Administrators should consult the Oracle Security Alert CSPUSEP2026 for the specific patch identifiers applicable to each supported version between 12.2.3 and 12.2.15, and follow Oracle's documented patch application procedures for E-Business Suite.
Workarounds
- Restrict network access to the Oracle E-Business Suite web tier to trusted internal networks or VPN users where feasible.
- Enforce strong authentication and session controls on all EBS accounts, including multi-factor authentication for administrative roles.
- Reduce privileged responsibilities assigned to shared or service accounts that interact with Oracle Installed Base until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
