This vulnerability exists in the Oracle Installed Base product component 'Create Item Instance' within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but it does not explicitly confirm patch availability or remediation level for this specific vulnerability. Customers are strongly advised to apply Oracle's security patches promptly as per the advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Installed Base, unauthorized access to all accessible data, and partial denial of service. This affects confidentiality, integrity, and availability of the system. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability as part of a broad set of security patches. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-62473 specifically. Customers should review the Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Installed Base versions 12.2.3 through 12.2.15 without delay. Maintaining up-to-date patched versions is strongly recommended to mitigate this vulnerability.