PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62473 Oracle Corporation CVE debrief

A vulnerability exists in Oracle Installed Base, a component of Oracle E-Business Suite. The affected versions are 12.2.3 through 12.2.15. This vulnerability is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to critical data, and partial denial of service. The vulnerability has a CVSS 3.1 Base Score of 8.3, indicating high severity. Organizations should prioritize patching this vulnerability to prevent potential exploitation.

Vendor
Oracle Corporation
Product
Oracle Installed Base
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-06
Advisory published
2026-07-21
Advisory updated
2026-08-06

Who should care

Organizations using Oracle E-Business Suite versions 12.2.3 through 12.2.15 should prioritize patching this vulnerability to prevent potential exploitation. This involves reviewing system configurations, updating access controls, and ensuring that security patches are applied promptly. Additionally, organizations should monitor Oracle Installed Base logs for suspicious activity and consider implementing additional security measures such as web application firewalls.

Technical summary

The vulnerability in Oracle Installed Base (component: Create Item Instance) of Oracle E-Business Suite (versions 12.2.3-12.2.15) allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can result in unauthorized data access, modification, and partial denial of service. The CVSS 3.1 Base Score is 8.3, indicating high severity. This vulnerability can be mitigated by applying the security patch provided by Oracle, reviewing and updating network access controls, and monitoring system logs for suspicious activity.

Defensive priority

Highly Critical

Recommended defensive actions

  • Apply the security patch provided by Oracle as soon as possible.
  • Review and update network access controls to limit exposure.
  • Monitor Oracle Installed Base logs for suspicious activity.
  • Consider implementing additional security measures such as web application firewalls.
  • Verify the integrity of data stored in Oracle Installed Base.

Evidence notes

The CVE record was published on 2026-07-21T22:19:03.677Z and was last modified on 2026-07-22T17:16:57.463Z. The NVD entry is currently under review. Oracle's security alert provides additional details. Evidence is limited, and defenders should verify the integrity of data stored in Oracle Installed Base and review system logs for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-62473 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-62473

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-62473 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-62473

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.