What is the CVSS score of CVE-2026-62473?

CVE-2026-62473 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Installed Base are affected by CVE-2026-62473?

Oracle E-Business Suite (EBS) versions 12.2.3-12.2.15 contain a high-severity vulnerability enabling any authenticated user to read, modify, or delete inventory and asset data-core to supply chain…

How to fix or mitigate CVE-2026-62473?

Within 24 hours: inventory all Oracle EBS deployments and identify systems running versions 12.2.3-12.2.15 in production, specifically those hosting Installed Base data. Within 7 days: restrict EBS network access to documented IP ranges and authorized service accounts only; enforce least-privilege provisioning and disable superfluous user accounts; activate database audit logging on all Installed Base schema modifications. Within 30 days: monitor Oracle support channels for CVE-2026-62473 patch availability and develop a tested upgrade plan for patched versions; conduct data integrity audit of Installed Base records to identify any unauthorized modifications since disclosure.

Oracle Installed Base CVE-2026-62473

EUVD-2026-47509 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-jrgw-w8f8-326v

Authentication Bypass Denial Of Service Information Disclosure Oracle Installed Base

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Network-reachable HTTP function abusable by any authenticated low-privileged user (PR:L, AC:L, UI:N) yields full data read/write (C:H/I:H) but only partial DoS (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:44 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.3

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Installed Base. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.

Technical ContextAI

Oracle Installed Base (IB) is the asset and product-instance tracking module of Oracle E-Business Suite, storing item instances that represent deployed products, their configurations, and ownership across the ERP suite. The flaw lives in the 'Create Item Instance' function, which is exposed over HTTP through the EBS web tier. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the vulnerable operation is reachable by any low-privileged authenticated user and that no server-side authorization check adequately constrains what data the operation can read or mutate. No CWE was assigned by the source, but the described behavior - an authenticated user gaining unauthorized read and write access to 'all Oracle Installed Base accessible data' - is consistent with a broken-access-control / missing-authorization root-cause class (CWE-284/CWE-862) rather than a memory-safety or injection bug.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch for this issue; the input does not specify a discrete fix build, so identify the exact patch for your 12.2.x level from the CPU matrix. If patching cannot be scheduled immediately, apply compensating controls: restrict which EBS responsibilities/roles can reach the Installed Base 'Create Item Instance' function so only users with a genuine business need retain access (side effect: legitimate IB users lose self-service item-instance creation until re-granted); place the EBS web tier behind network access controls or a WAF and limit HTTP exposure to trusted internal networks or VPN (side effect: may break external integrations that call IB endpoints); and increase monitoring of Installed Base data changes and item-instance creation events to detect unauthorized read/modify/delete activity. None of these fully substitute for the CPU patch, since the underlying authorization weakness remains.