Oracle Installed Base CVE-2026-101849

Exploitation requires the attacker to hold a low-privileged authenticated account on Oracle E-Business Suite (PR:L) with network/HTTP access to the Installed Base module's Create Item Instance function, and it requires human interaction from a different victim user (UI:R) to complete the attack. Affected deployments are limited to EBS versions 12.2.3 through 12.2.15. The authentication requirement and mandatory second-party interaction are the primary limiting factors reducing real-world exploitability, but the scope change (S:C) expands impact to additional connected Oracle products beyond Installed Base itself.

This is a genuine, prioritize-for-patching issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, base 7.6) shows network-reachable, low-complexity exploitation requiring only low privileges - an authenticated EBS user - plus interaction from a victim other than the attacker. The scope change (S:C) is the key risk amplifier: Oracle explicitly states attacks may significantly impact products beyond Installed Base, and confidentiality impact is High (complete read of Installed Base-accessible data). No EPSS score, CISA KEV listing, POC, or SSVC assessment is provided in the input, so there is no signal of active exploitation or automatability - exploitation status is unknown rather than confirmed. The required user interaction (UI:R) and authentication (PR:L) meaningfully lower real-world likelihood versus an unauthenticated drive-by. Net: a real priority for any Oracle EBS 12.2.x shop given the sensitivity of ERP data and the scope change, but the authenticated + interaction prerequisites mean it is more plausibly a targeted/insider-leveraged vector than a mass-exploited one. The input Tag 'Authentication Bypass' conflicts with the CVSS vector, which requires existing privileges (PR:L) - this appears to be a mislabeled tag, not an auth-bypass flaw.

A low-privileged authenticated Oracle E-Business Suite user crafts a malicious request or link against the Create Item Instance function of the Installed Base module and induces another EBS user (e.g. a higher-context operator) to interact with it. The interaction triggers the flaw, exposing critical Installed Base data and allowing limited unauthorized modification, with impact extending to additional connected products due to the scope change. No public exploit code is identified at time of analysis.