Oracle Installed Base CVE-2026-62472

Exploitation requires network HTTP access to the Oracle E-Business Suite application tier and a valid low-privileged EBS account (CVSS PR:L) - it is not fully unauthenticated despite the 'Authentication Bypass' tag. The affected code path is specifically the Installed Base 'Create Item Instance' component in EBS 12.2.4 through 12.2.15, so exposure is limited to deployments running those versions with the Installed Base (CSI) module enabled and reachable. No user interaction and no elevated/admin privileges are needed and attack complexity is low, which lowers the bar considerably once any authenticated foothold exists; the primary limiting factors are the requirement for an authenticated account and network reachability of the EBS web tier (internet-facing EBS deployments are at materially higher risk than internally segmented ones).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact - a genuinely serious authorization issue that Oracle rates 8.1. However, several key risk signals are absent from the input: no EPSS exploitation probability was supplied, the vulnerability is not on CISA KEV, and no proof-of-concept was referenced, so there is no evidence of active or automated exploitation at this time. A notable conflict must be flagged: the source tag says 'Authentication Bypass' (implying no credentials needed) while the CVSS vector specifies PR:L (a valid low-privileged account is required) - these are contradictory, and the CVSS-derived requirement for authenticated access should be treated as the more precise signal until Oracle clarifies. Net assessment: high priority to patch for organizations running EBS 12.2.x with Installed Base, because EBS instances often hold sensitive business/asset data and low-privilege EBS accounts are common, but the current lack of KEV/EPSS/POC data suggests it is not yet under widespread active attack.

An attacker holding a low-privilege Oracle E-Business Suite account (for example, a limited self-service or departmental user) sends crafted HTTP requests to the Installed Base 'Create Item Instance' functionality and, exploiting the authorization weakness, reads, alters, or deletes item-instance and asset data across the entire Installed Base module beyond their intended scope. Because attack complexity is low and no user interaction is required, the action can be scripted once a valid account is obtained; no public proof-of-concept is currently known.