CVE-2026-87152
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance), affecting versions 12.2.3-12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized creation, deletion or modification access to critical data as well as unauthorized access to Oracle Installed Base data.
Risk Assessment
An attacker with low privileges can compromise confidentiality and integrity of critical business data. The high CVSS score of 8.1 indicates significant risk for organizations using Oracle E-Business Suite.
Recommendation
Immediately apply the available Oracle security updates for Oracle E-Business Suite and restrict network access to the component to trusted users.
Other vulnerabilities in Oracle Installed Base
See all- CVE-2017-3361High
A vulnerability in the Oracle Installed Base component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction, potentially leading to unauthorized access to critical data.
- CVE-2026-70775Medium
Vulnerability in Oracle Installed Base (component: User Interface) versions 12.2.3-12.2.15. Easily exploitable, allows low privileged attacker via HTTP to perform unauthorized update, read of some data and cause partial denial of service.
- CVE-2026-62473High
Vulnerability in Oracle Installed Base (Create Item Instance component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
- CVE-2026-62472High
Vulnerability in Oracle Installed Base (component: Create Item Instance) in Oracle E-Business Suite. A low-privileged attacker via HTTP can compromise data confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60908High
Vulnerability in Oracle Installed Base (component: Create Item Instance) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized access to all data and modify some data.
- CVE-2026-60907Medium
Vulnerability in Oracle Installed Base (component: Create Item Instance) versions 12.2.4-12.2.15. Difficult to exploit; a low-privileged attacker via HTTP can gain unauthorized read, modify access and cause partial denial of service.
- CVE-2026-60904High
Vulnerability in Oracle Installed Base (Create Item Instance component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
- CVE-2026-60738High
Vulnerability in Oracle Installed Base (Create Item Instance component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS