Installed Base CVE-2026-60738

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a high-severity vulnerability in the Installed Base module that enables any low-privileged authenticated EBS user to completely compromise the confidentiality, integrity, and availability of asset and inventory management data. Organizations running affected versions risk operational disruption to mission-critical inventory tracking and supply chain processes.

Within 24 hours, identify all systems running Oracle EBS 12.2.3 through 12.2.15 and verify Installed Base module deployment; alert relevant business stakeholders to the high-impact risk to asset management functions; establish enhanced monitoring for suspicious Installed Base activity. Within 7 days, restrict Create Item Instance permissions to minimal essential administrative staff only; implement mandatory multi-factor authentication for all EBS access; enable detailed audit logging of Installed Base transactions. Within 30 days, monitor Oracle's Critical Patch Updates for vendor-released fixes to CVE-2026-60738; develop and test an upgrade strategy to version 12.2.16 or later; prioritize patching production instances managing critical assets.

No vendor-released patch identified at time of analysis. Implement strict least-privilege access controls for the Installed Base module, limiting Create Item Instance functionality to essential administrative users only; enforce multi-factor authentication for all Oracle EBS access; enable comprehensive transaction-level audit logging with real-time alerting for anomalous Installed Base activity; consider network segmentation to restrict EBS access from untrusted zones; maintain offline backups of critical Installed Base data.