This vulnerability in Oracle Installed Base versions 12.2.4 to 12.2.15 involves the Create Item Instance component and permits a low privileged attacker with network access via HTTP to compromise the product. Exploitation can lead to unauthorized data modification (update, insert, delete), unauthorized read access to some data, and partial denial of service conditions. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but is part of Oracle's July 2026 Critical Patch Update cycle, which includes numerous security fixes. Customers are urged to remain on supported versions and apply patches without delay.

Successful exploitation can result in unauthorized modification (update, insert, delete) of some Oracle Installed Base accessible data, unauthorized read access to a subset of that data, and the ability to cause a partial denial of service affecting availability. The impact is limited to confidentiality, integrity, and availability with low severity on each, consistent with the CVSS score of 5.0.

The vendor advisory does not explicitly state that a patch is available or provide a remediation level for this vulnerability. Oracle's general guidance is to remain on actively supported versions and apply Critical Patch Updates promptly. Users of Oracle Installed Base versions 12.2.4 through 12.2.15 should monitor Oracle's July 2026 Critical Patch Update documentation and apply relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html