This vulnerability affects Oracle Installed Base component 'Create Item Instance' in Oracle E-Business Suite version 12.2.3. It allows an attacker with low privileges and network access over HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vulnerability is publicly disclosed and assigned CVE-2026-62473. Oracle's July 2026 Critical Patch Update advisory includes multiple patches but does not explicitly confirm a fix for this version. Patch status is not yet confirmed; users must verify the vendor advisory for current remediation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Installed Base, unauthorized access to all accessible data, and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system, potentially compromising critical business data and operations.

Oracle has published a Critical Patch Update advisory for July 2026 that addresses multiple vulnerabilities across Oracle products. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle Installed Base version 12.2.3 regarding CVE-2026-62473. Therefore, patch status is not yet confirmed — users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions.