This vulnerability exists in the Oracle Installed Base product of Oracle E-Business Suite, specifically in the Create Item Instance component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access and modification of critical data within Oracle Installed Base. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. The affected versions explicitly include 12.2.4 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a patch for this vulnerability in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Installed Base, resulting in full compromise of accessible data confidentiality and integrity. This could severely affect business operations relying on accurate and secure data in Oracle Installed Base. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Installed Base HTTP interfaces to trusted users only and monitor for suspicious activity related to unauthorized data changes.