This vulnerability in Oracle Installed Base (component: Create Item Instance) affects supported versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized access to critical data or full access to all accessible data within Oracle Installed Base. Additionally, the attacker may gain unauthorized capabilities to update, insert, or delete some of the accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Installed Base, as well as unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Installed Base HTTP interfaces to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.