CVE-2026-62473 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle E-Business Suite versions 12.2.3 through 12.2.15 should prioritize patching this vulnerability to prevent potential exploitation. This involves reviewing system configurations, updating access controls, and ensuring that security patches are applied promptly. Additionally, organizations should monitor Oracle Installed Base logs for suspicious activity and consider implementing additional security measures such as web application firewalls.

Technical summary

The vulnerability in Oracle Installed Base (component: Create Item Instance) of Oracle E-Business Suite (versions 12.2.3-12.2.15) allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can result in unauthorized data access, modification, and partial denial of service. The CVSS 3.1 Base Score is 8.3, indicating high severity. This vulnerability can be mitigated by applying the security patch provided by Oracle, reviewing and updating network access controls, and monitoring system logs for suspicious activity.

Defensive priority

Highly Critical

Recommended defensive actions

• Apply the security patch provided by Oracle as soon as possible.
• Review and update network access controls to limit exposure.
• Monitor Oracle Installed Base logs for suspicious activity.
• Consider implementing additional security measures such as web application firewalls.
• Verify the integrity of data stored in Oracle Installed Base.

Evidence notes

The CVE record was published on 2026-07-21T22:19:03.677Z and was last modified on 2026-07-22T17:16:57.463Z. The NVD entry is currently under review. Oracle's security alert provides additional details. Evidence is limited, and defenders should verify the integrity of data stored in Oracle Installed Base and review system logs for suspicious activity.

Official resources