This vulnerability exists in the Create Item Instance component of Oracle Installed Base versions 12.2.4 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Installed Base. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Installed Base. This compromises data confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific patch or fix information is provided in the advisory content for this vulnerability at this time.