This vulnerability affects the Oracle Installed Base product within Oracle E-Business Suite, specifically the Create Item Instance component. It is exploitable remotely over the network via HTTP by an attacker with low privileges. Successful exploitation can lead to unauthorized modification (update, insert, delete) and limited unauthorized reading of accessible data, as well as partial denial of service conditions. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The affected versions explicitly include 12.2.4 through 12.2.15. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a July 2026 Critical Patch Update containing many patches. Customers are strongly advised to apply available patches promptly.

An attacker with low privileges and network access can gain unauthorized ability to read some data, modify data (update, insert, delete), and cause partial denial of service in Oracle Installed Base. The impact on confidentiality, integrity, and availability is rated low but still significant enough to warrant attention. This could lead to data manipulation and service disruption within affected Oracle Installed Base deployments.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities, including those in Oracle Installed Base. Customers should review the July 2026 Critical Patch Update advisory and apply the relevant patches without delay. No explicit temporary mitigations or workarounds are provided in the advisory. Maintaining up-to-date patches is the primary recommended mitigation.