Oracle Installed Base CVE-2026-62473

Exploitation requires a valid low-privileged, authenticated Oracle E-Business Suite account (CVSS PR:L) with HTTP network access to the EBS web tier, and the target must run an affected Oracle Installed Base release (12.2.3-12.2.15) with the Create Item Instance component reachable. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an account is held the operation can be invoked directly against default deployments. The primary limiting factor is the authentication requirement - this is not a pre-auth vulnerability despite the 'Authentication Bypass' tag, which conflicts with the PR:L vector and should be confirmed with Oracle. Exploitation is further bounded to organizations running EBS 12.2 with the Installed Base module deployed and its web endpoints network-accessible to the attacker.

The signals are moderately consistent and point to a real but not emergency-tier risk. CVSS 3.1 is 8.3 (High), driven by network reachability, low attack complexity, no user interaction, and combined high confidentiality/integrity plus low availability impact; the only friction is PR:L, meaning the attacker must already hold a low-privileged EBS account. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probability of exploitation and automatability cannot be quantified from the input - treat the absence as 'unknown,' not 'low.' The 'Authentication Bypass' tag is worth flagging as potentially conflicting: the CVSS vector explicitly requires privileges (PR:L), so this is privilege abuse / broken access control by an authenticated user rather than a true unauthenticated bypass - verify the exact precondition with Oracle before assuming pre-auth exploitability. Net: a credible insider-or-compromised-account threat against a high-value ERP data store; prioritize during the normal Oracle CPU cycle rather than as an out-of-band emergency, absent evidence of active exploitation.

An attacker who has obtained any low-privileged Oracle E-Business Suite account - for example a phished employee login or a compromised self-service user - sends crafted HTTP requests to the Installed Base 'Create Item Instance' function and, because server-side authorization is insufficient, reads, alters, or deletes item-instance records well beyond their intended scope. This lets them exfiltrate sensitive asset data, tamper with critical ERP records, or degrade the module's availability. No public exploit code was identified at time of analysis, so an attacker would need to develop the request sequence themselves.